{"uuid": "81035935-dd1d-4ed9-bb8a-b7c4ea6d8da4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-41244", "type": "seen", "source": "https://t.me/cyberwarehouse/957", "content": "You name it, VMware elevates it (CVE-2025-41244)\nhttps://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/:\n\n1. When service discovery operates in the modern credential-less mode, the VMware Tools will eventually trigger the privilege escalation once it runs the collector plugin.\n2. Under certain circumstances, exploitation may forensically be confirmed in legacy credential-based mode through the analysis of lingering metrics collector scripts and outputs under the /tmp/VMware-SDMP-Scripts-{UUID}/ folders.\n3. The broad practice of mimicking system binaries (e.g., httpd) highlight the real possibility that several other malware strains have accidentally been benefiting from unintended privilege escalations for years.\n\n@secharvester", "creation_timestamp": "2026-07-26T02:00:08.714407Z"}