CVE-2025-41225

The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.

Score

CVSS 3.1 8.8 High

Status

Deferred - security@vmware.com

Published

2025-05-20

Last modified

2025-06-24

Weaknesses

CWE-78

Affected products

• Cloud Foundation (Vmware)
• Telco Cloud Infrastructure (Vmware)
• Telco Cloud Platform (Vmware)
• Vcenter Server (Vmware)

References

• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717