CVE-2025-41225

No fix known EPSS <1%CVSS 8.8

The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.

Published 2025-05-20 · CVE record · OSV

Products: VMware vCenter Server, vmware cloud_foundation, VMware Telco Cloud Platform, VMware Telco Cloud Infrastructure