Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2025-41246

Improper authorisation vulnerability

High7.6EPSS 0.28%
Published
Updated
Reserved
Assigned by
vmware

Description

VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this issue to access other guest VMs. Successful exploitation requires knowledge of credentials of the targeted VMs and vCenter or ESX.

Scores

CVSS scores of CVE-2025-41246, by who scored it
Scored byCVSSScoreVector
vmwareCNA (assigner)3.1High7.6CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
NVDNVD · Deferred3.1High7.6CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.28% · top 80% of all CVEs (5 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.6.

Weakness

Affected products

  • VMware · Tools

    • affected 13.x.x.x – < 13.0.5.0
    • affected 12.x.x – < 12.5.4
    • affected 11.x.x

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-41246 badge
[![CVE-2025-41246](https://trackcve.app/badge/CVE-2025-41246.svg)](https://trackcve.app/cve/CVE-2025-41246)

Record last updated .