Description
The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VMware | vCenter Server | 8.0 – < 8.0 U3e, 7.0 – < 7.0 U3v | 8.0 U3e |
| VMware | Cloud Foundation | 5.x, 4.5.x | — |
| VMware | Telco Cloud Platform | 5.x, 4.x, 3.x, 2.x | — |
| VMware | Telco Cloud Infrastructure | 3.x, 2.x | — |
Advisories 2
- WID-SEC-2025-1113 VMware Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2025
- NCSC-2025-0171 Kwetsbaarheden verholpen in VMware producten NCSC-NL (Netherlands) · May 21, 2025