CISA Mandates Patching of VMware Tools Privilege Escalation Vulnerability Exploited by Chinese Threat Actors

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to urgently patch a high-severity local privilege escalation vulnerability, tracked as CVE-2025-41244, affecting Broadcom's VMware Aria Operations and VMware Tools. This flaw allows attackers with non-administrative access to a virtual machine, when managed by Aria Operations with SDMP enabled, to escalate privileges to root. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog after confirmation that it has been actively exploited in the wild, with exploitation attributed to the Chinese state-sponsored group UNC5174 since October 2024. Federal Civilian Executive Branch agencies have been given a three-week deadline to apply patches, and all organizations are strongly urged to prioritize remediation due to the significant risk posed by this vulnerability.

Broadcom patched CVE-2025-41244 one month prior to CISA's directive, and proof-of-concept code demonstrating exploitation has been publicly released. The vulnerability is considered a frequent attack vector for malicious cyber actors, and CISA's Binding Operational Directive 22-01 requires agencies to apply mitigations or discontinue use if patches are unavailable. While the directive is mandatory for federal agencies, CISA recommends that all organizations, regardless of sector, address the vulnerability immediately to prevent potential compromise of virtualized environments managed by VMware Tools and Aria Operations.