VMware Aria Operations contains a privilege escalation flaw. A user who already has vCenter access can use the vulnerability to obtain administrator rights within Aria Operations. This gives the attacker the ability to modify, delete, or create configurations, view sensitive data, and potentially impact other connected VMware services. The weakness maps to Improper Privilege Management (CWE‑269).

Affected products include VMware Aria Operations, VMware Cloud Foundation, VMware Telco Cloud Infrastructure, and VMware Telco Cloud Platform. The advisory specifies fixes for Aria Operations 8.18.6 (for all 8.x releases) and Cloud Foundation Operations 9.0.2.0 (for all 9.x releases). Earlier versions of these products are considered vulnerable until the listed patches are applied.

The CVSS score of 6.2 indicates a medium severity; the EPSS score of less than 1% denotes a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely an authenticated scenario where the attacker already has some vCenter permissions and can then move into Aria Operations. An attacker would need ability to send requests to the Aria Operations API from a user with vCenter privileges to trigger the privilege escalation.