{"uuid": "8ee034d4-5e19-481f-8cfc-7a54eb6905cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-41244", "type": "published-proof-of-concept", "source": "https://t.me/cyberwarehouse/957", "content": "You name it, VMware elevates it (CVE-2025-41244)\nhttps://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/:\n\n1. When service discovery operates in the modern credential-less mode, the VMware Tools will eventually trigger the privilege escalation once it runs the collector plugin.\n2. Under certain circumstances, exploitation may forensically be confirmed in legacy credential-based mode through the analysis of lingering metrics collector scripts and outputs under the /tmp/VMware-SDMP-Scripts-{UUID}/ folders.\n3. The broad practice of mimicking system binaries (e.g., httpd) highlight the real possibility that several other malware strains have accidentally been benefiting from unintended privilege escalations for years.\n\n@secharvester", "creation_timestamp": "2026-07-27T00:00:31.744458Z"}