Research · Sep 29, 2025 · ZeroDay Catalog
Privilege Escalation Vulnerability in VMware Aria Operations and VMware Tools
A critical privilege escalation vulnerability has been identified in Broadcom's VMware Aria Operations and VMware Tools, potentially allowing local actors to gain root access.
What changed
A vulnerability has been discovered in Broadcom's VMware Aria Operations and VMware Tools that allows a local actor with non-administrative privileges to escalate their access to root level on a virtual machine. This issue arises from a privilege defined with unsafe actions, particularly when the software is managed under specific configurations.
The potential for exploitation is significant, especially in environments where VMware Tools is installed and managed by Aria Operations with SDMP enabled.
Who is affected
Organizations utilizing Broadcom's VMware Aria Operations and VMware Tools are at risk, particularly those with virtual machines configured with the vulnerable settings.
The following groups are specifically affected:
- Users of VMware Aria Operations
- Users of VMware Tools
- Organizations with virtual machines managed under SDMP configurations
What to do
It is crucial for affected organizations to assess their environments for the presence of this vulnerability. Immediate action should be taken to mitigate the risk of privilege escalation.
Consider implementing the following measures:
- Review and update VMware Aria Operations and VMware Tools to the latest patched versions.
- Limit access to virtual machines to only those users who require it.
- Monitor for unusual activity that may indicate exploitation attempts.