CVE-2025-41245 Information disclosure in VMware Aria Operations
A malicious actor with non-administrative privileges can disclose credentials of other users in VMware Aria Operations.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-41245?
CVE-2025-41245 is a medium-severity vulnerability in VMware Aria Operations, published on 29 Sep 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of Aria Operations.
Weakness: CWE-1188
Which versions are affected by CVE-2025-41245?
How do I fix CVE-2025-41245?
No fix has been published for CVE-2025-41245 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-41245 being exploited?
There is no known exploitation of CVE-2025-41245 in the wild and no public exploit code.
Sources
Also known as GHSA-8rq8-hfwr-4p7v.