
- CISA added CVE-2025-41244 to KEV, mandating patching by November 20
- The bug enables local privilege escalation via VMware Tools with SDMP enabled
- Chinese group UNC5174 exploited it for espionage targeting Western and Asian institutions
The US Cybersecurity and Infrastructure Security Agency (CISA) has added a new Broadcom bug to its Known Exploited Vulnerabilities (KEV) catalog, warning Federal Civilian Executive Branch (FCEB) agencies about in-the-wild abuse.