CVE-2025-41244: aria operations from 8.0 (inclusive), before 8.18.5 (exclusive); +13 more affected products

Affected technology

aria operations · from 8.0 (inclusive), before 8.18.5 (exclusive)
vmware

cloud foundation · from 4.0 (inclusive), through 5.2.2 (inclusive)
vmware

cloud foundation operations · 9.0
vmware

open vm tools · from 11.2.0 (inclusive), before 12.5.4 (exclusive)
vmware

open vm tools · 13.0.0
vmware

telco cloud infrastructure · from 2.2 (inclusive), through 3.0 (inclusive)
vmware

telco cloud platform · from 4.0 (inclusive), before 5.0.1 (exclusive)
vmware

debian linux · 11.0
debian

tools · from 12.5.0 (inclusive), before 12.5.4 (exclusive)
vmware

tools · from 13.0.0.0 (inclusive), before 13.0.5.0 (exclusive)
vmware

VCF operations · 9.0.x to before 9.0.1.0
VMware

VMware tools · 13.x.x.x to before 13.0.5.0, 12.5.x to before 12.5.4
VMware

VMware Aria Operations · 8.18.x to before 8.18.5
VMware

VMware Cloud Foundation · 5.x to before 8.18.5, 4.x to before 8.18.5
VMware

VMware Telco Cloud Platform · 5.x to before 8.18.5, 4.x to before 8.18.5
VMware

VMware Telco Cloud Infrastructure · 3.x to before 8.18.5, 2.x to before 8.18.5
VMware

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could gain higher privileges. Vendor/CNA’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high.