What’s Vulnerable › Vulnerabilities
CVE-2025-41245: VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
- Severity: medium (CVSS 4.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-09-29 · updated 2026-10-18
- Weakness: CWE-1188
Description
VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations.
Affected products
- VMware Aria Operations: from 8.18.x before 8.18.5 — fixed in 8.18.5
- VMware Cloud Foundation: from 5.x before 8.18.5; from 4.x before 8.18.5 — fixed in 8.18.5
- VMware Telco Cloud Infrastructure: from 3.x before 8.18.5; from 2.x before 8.18.5 — fixed in 8.18.5
- VMware Telco Cloud Platform: from 5.x before 8.18.5; from 4.x before 8.18.5 — fixed in 8.18.5
How to fix
Upgrade to a fixed version: VMware Aria Operations 8.18.5; VMware Cloud Foundation 8.18.5; VMware Telco Cloud Infrastructure 8.18.5; VMware Telco Cloud Platform 8.18.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-41245 or the next vulnerability affects your stack