CVE-2025-41245: VMware Aria Operations

Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days.

VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations.

Affected products

• VMware VMware Aria Operations: from 8.18, before 8.18.5 (fixed in 8.18.5)
• VMware VMware Cloud Foundation: from 5, before 8.18.5 (fixed in 8.18.5); from 4, before 8.18.5 (fixed in 8.18.5)
• VMware VMware Telco Cloud Infrastructure: from 3, before 8.18.5 (fixed in 8.18.5); from 2, before 8.18.5 (fixed in 8.18.5)
• VMware VMware Telco Cloud Platform: from 5, before 8.18.5 (fixed in 8.18.5); from 4, before 8.18.5 (fixed in 8.18.5)

Published 2025-09-29. Last modified 2026-06-17.