{"id":"CVE-2025-41225","aliases":["EUVD-2025-15833","GHSA-2687-xwfr-5fx9"],"status":"published","title":"VMware vCenter Server authenticated command-execution vulnerability","description":"The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00258,"percentile":0.1765,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2025-05-20T14:24:17Z","modified":"2026-06-17T09:22:37Z","products":[{"vendor":"vmware","product":"cloud foundation"},{"vendor":"vmware","product":"telco cloud infrastructure"},{"vendor":"vmware","product":"telco cloud platform"},{"vendor":"vmware","product":"vcenter server"},{"vendor":"vmware","product":"vmware cloud foundation"},{"vendor":"vmware","product":"vmware telco cloud infrastructure"},{"vendor":"vmware","product":"vmware telco cloud platform"}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-41225"},{"url":"https://github.com/advisories/GHSA-2687-xwfr-5fx9"}],"sources":{"cve":[{"id":"CVE-2025-41225","title":"VMware vCenter Server authenticated command-execution vulnerability","description":"The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.","status":"published","published":"2025-05-20T14:24:17.487Z","modified":"2025-06-24T07:11:20.683Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:31.631102Z"}],"euvd":[{"id":"EUVD-2025-15833","description":"The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.","status":"published","published":"2025-05-20T14:24:17Z","modified":"2025-06-24T07:11:20Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:17.4539Z"}],"ghsa":[{"id":"GHSA-2687-xwfr-5fx9","title":"The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor...","description":"The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.","status":"published","published":"2025-05-20T15:30:40Z","modified":"2025-05-20T15:30:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:02:21.932853Z"}],"nvd":[{"id":"CVE-2025-41225","description":"The vCenter Server contains an authenticated command-execution vulnerability. A malicious actor with privileges to create or modify alarms and run script action may exploit this issue to run arbitrary commands on the vCenter Server.","status":"published","published":"2025-05-20T15:16:07.527Z","modified":"2026-06-17T09:22:37.87Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:11:09.125937Z"}]}}