PT-2025-39836 · Vmware · Vmware Aria Operations

Published 2025-09-09 · Updated 2026-03-19 · CVE-2025-41245

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware Aria Operations (affected versions not specified)

Description VMware Aria Operations has an information disclosure issue due to insecure resource initialization. An attacker operating remotely may be able to reveal sensitive information. A malicious actor with non-administrative privileges within Aria Operations may exploit this to disclose credentials of other Aria Operations users. Additionally, VMware Aria Operations and VMware Tools contain a local privilege escalation issue. A local malicious actor with non-administrative privileges, with access to a virtual machine with VMware Tools installed and managed by Aria Operations with SDMP enabled, may be able to escalate privileges to root on the same virtual machine.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1188

Related Identifiers

BDU:2025-12432

CVE-2025-41245

Affected Products

Vmware Aria Operations

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2025-41245 · Security Note
• https://bdu.fstec.ru/vul/2025-12432 · Security Note
• https://twitter.com/autumn_good_35/status/1972697023758684422 · Twitter Post
• https://twitter.com/lucasverdan/status/2034450793508811065 · Twitter Post
• https://twitter.com/SynCloudBugs/status/1974191317661200862 · Twitter Post
• https://twitter.com/rst_cloud/status/1974184468660330516 · Twitter Post
• https://twitter.com/ripjyr/status/1972767535201452494 · Twitter Post
• https://t.me/CVEtracker/33631 · Telegram Post
• https://t.me/cveNotify/141912 · Telegram Post
• https://reddit.com/r/vmware/comments/1nu5tqg/vmsa_double_feature_vmsa20250015_and_vmsa20250016 · Reddit Post
• https://twitter.com/UjlakiMarci/status/1972919139678208083 · Twitter Post
• https://twitter.com/CVEnew/status/1972707689936593293 · Twitter Post
• https://twitter.com/VivekIntel/status/2034311803648581851 · Twitter Post
• https://t.me/aptreports/22529 · Telegram Post
• http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149 · Note