CVE-2025-41250
VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks.
- Score
- CVSS 3.1 8.5 High
- Status
- Deferred - security@vmware.com
- Published
- 2025-09-29
- Last modified
- 2026-10-18
- Weaknesses
- CWE-77
Affected products
- Cloud Foundation (Vmware)
- Telco Cloud Infrastructure (Vmware)
- Telco Cloud Platform (Vmware)
- Vcenter (Vmware)
- Vsphere Foundation (Vmware)
References
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36150
