Skip to content
OpenAdvisories
High WID-SEC-2025-1113 4 CVEs

VMware Produkte: Mehrere Schwachstellen

Published May 20, 2025 · Updated Aug 11, 2025 · Revision 2 · de-DE

Vendor: VMware Product: Cloud Foundation Product: ESXi Product: Fusion Product: vCenter Server Product: Workstation Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in VMware vCenter Server, VMware Cloud Foundation, VMware ESXi, VMware Workstation und VMware Fusion ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service auszulösen oder XSS durchzuführen.

Product

Die Virtualisierungssoftware von VMware ermöglicht die simultane Ausführung von verschiedenen Betriebssystemen auf einem Host-System.
VMware Cloud Foundation ist eine Hybrid Cloud-Plattform für VM-Management und Container-Orchestrierung.

Vulnerabilities 4

  • High 8.8
    CVE-2025-41225

    VMware vCenter Server authenticated command-execution vulnerability

    The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.

    VMware Cloud Foundation Telco Cloud Platform Telco Cloud Infrastructure Virtualization
  • Medium 6.8
    CVE-2025-41226

    Guest Operations Denial-of-Service Vulnerability

    VMware ESXi contains a denial-of-service vulnerability that occurs when performing a guest operation. A malicious actor with guest operation privileges on a VM, who is already authenticated through vCenter Server or ESXi may trigger this issue to create a den…

    VMware ESXi Telco Cloud Platform Cloud Foundation Virtualization
  • Medium 5.5
    CVE-2025-41227

    Denial-of-Service Vulnerability

    VMware ESXi, Workstation, and Fusion contain a denial-of-service vulnerability due to certain guest options. A malicious actor with non-administrative privileges within a guest operating system may be able to exploit this issue by exhausting memory of the hos…

    VMware Workstation Fusion ESXi Virtualization
  • Medium 4.3
    CVE-2025-41228 Public exploit

    VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) Vulnerability

    VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal co…

    VMware ESXi Cloud Foundation Telco Cloud Platform Virtualization

Revision history

  1. #2

    Exploit für CVE-2025-41228 aufgenommen

  2. #1

    Initiale Fassung

References