CVE-2025-41225

VMware vCenter Server authenticated command-execution vulnerability

State: Published
Severity: 8.8 High
Published: May 20, 2025
Updated: Jun 24, 2025
Reserved: Apr 16, 2025

Description

The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	vmware

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
vCenter ServerVMware	8.0 to before 8.0 U3eAffected 7.0 to before 7.0 U3vAffected
Cloud FoundationVMware	5.x, 4.5.xAffected
Telco Cloud PlatformVMware	5.x, 4.x, 3.x, 2.xAffected
Telco Cloud InfrastructureVMware	3.x, 2.xAffected

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.