What’s Vulnerable › Vulnerabilities

CVE-2025-41225: VMware vCenter Server authenticated command-execution vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-20 · updated 2026-06-17
• Weakness: CWE-78

Description

The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.

Affected products

• VMware Cloud Foundation: 5.x, 4.5.x
• VMware Telco Cloud Infrastructure: 3.x, 2.x
• VMware Telco Cloud Platform: 5.x, 4.x, 3.x, 2.x
• VMware vCenter Server: from 8.0 before 8.0 U3e; from 7.0 before 7.0 U3v — fixed in 7.0 U3v, 8.0 U3e

How to fix

Upgrade to a fixed version: VMware vCenter Server 7.0 U3v, 8.0 U3e. Check the vendor advisory for mitigations.

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717

Get alerted when CVE-2025-41225 or the next vulnerability affects your stack