CVE-2025-41250 HIGH

CVE-2025-41250: Header injection vulnerability

Vendor Vmware
Product vCenter
Weakness CWE-77
Published September 29, 2025
Last update February 26, 2026

CVSS base score

8.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L

What the vulnerability does

01Description

VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks.

Key dates

02Disclosure timeline

September 29, 2025 CVE published
February 26, 2026 Record updated