CVE-2025-41250

No fix known EPSS <1%CVSS 8.5

VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks.

Published 2025-09-29 · CVE record · OSV

Products: VMware vCenter, vmware cloud_foundation, VMware Telco Cloud Platform, VMware Telco Cloud Infrastructure, VMware vSphere Foundation