VMware Aria Operations vulnerabilities

2 CVEs affecting VMware Aria Operations, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-41245, published 2025-09-29.

More from VMware.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-41245, published 2025-09-29. Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days. VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials…
• CVE-2025-22231, published 2025-04-01. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can escalate their privileges to root on the appliance running…