CVE-2025-41225CWE-78

VMware vCenter Server authenticated command-execution vulnerability

High · published May 20, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00258 · 16.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-05-20T14:24Z
EPSS history
Timeline
  • 20 MAY 14:24Z
    VMware vCenter Server authenticated command-execution vulnerability
    cvelistv5