CVE-2025-41225

VMware vCenter Server authenticated command-execution vulnerability

High8.8EPSS 0.26%

Published: 20 May 2025
Updated: 24 Jun 2025
Reserved: 16 Apr 2025
Assigned by: vmware

Description

The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.

Scores

CVSS scores of CVE-2025-41225, by who scored it
Scored by	CVSS	Score	Vector
vmwareCNA (assigner)	3.1	High8.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVDNVD · Deferred	3.1	High8.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.26% · top 82% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

VMware · vCenter Server
- affected 8.0 – < 8.0 U3e
- affected 7.0 – < 7.0 U3v
VMware · Cloud Foundation
- affected 5.x, 4.5.x
VMware · Telco Cloud Platform
- affected 5.x, 4.x, 3.x, 2.x
VMware · Telco Cloud Infrastructure
- affected 3.x, 2.x

References (1)

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-41225](https://trackcve.app/badge/CVE-2025-41225.svg)](https://trackcve.app/cve/CVE-2025-41225)

Record last updated 24 Jun 2025, 07:11 UTC.