CVE-2025-41225 HIGH

CVE-2025-41225: VMware vCenter Server authenticated command-execution vulnerability

Vendor Vmware
Product vCenter Server
Weakness CWE-78
Published May 20, 2025
Last update June 24, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.

Key dates

02Disclosure timeline

May 20, 2025 CVE published
June 24, 2025 Record updated