CVE-2025-41225 — VMware vCenter Server authenticated command-execution vulnerability

CVE-2025-41225

VMware vCenter Server authenticated command-execution vulnerability PUBLISHED

Description (CNA)

The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.

Affected (CNA)

Vendor / product	Versions
VMware / vCenter Server	affected 8.0 before 8.0 U3e; affected 7.0 before 7.0 U3v
VMware / Cloud Foundation	affected 5.x, 4.5.x
VMware / Telco Cloud Platform	affected 5.x, 4.x, 3.x, 2.x
VMware / Telco Cloud Infrastructure	affected 3.x, 2.x

CWE

CWE-78

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.