TI-2025-27473 Aliases CVE-2025-41226 GHSA-jfjv-vw9w-9w8v

Guest Operations Denial-of-Service Vulnerability

LOW 30CWE-400Published 2025-05-20 · Updated 2025-06-24

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

VMware ESXi contains a denial-of-service vulnerability that occurs when performing a guest operation. A malicious actor with guest operation privileges on a VM, who is already authenticated through vCenter Server or ESXi may trigger this issue to create a denial-of-service condition of guest VMs with VMware Tools running and guest operations enabled.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00242 15th percentileScored 2026-11-07

Fix Fixed ESXi (VMware): ESXi80U3se-24659227, ESXi70U3sv-24723868

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VMware	ESXi	8.0 to before ESXi80U3se-24659227; 7.0 to before ESXi70U3sv-24723868	ESXi80U3se-24659227, ESXi70U3sv-24723868	Patch available	CNA
VMware	Cloud Foundation	5.x, 4.5.x	—	No fix listed	CNA
VMware	Telco Cloud Platform	5.x, 4.x, 3.x, 2.x	—	No fix listed	CNA
VMware	Telco Cloud Infrastructure	3.x, 2.x	—	No fix listed	CNA

ESXi VendorVMware Affected 8.0 to before ESXi80U3se-24659227; 7.0 to before ESXi70U3sv-24723868 Fixed in ESXi80U3se-24659227, ESXi70U3sv-24723868 Patch available CNA
Cloud Foundation VendorVMware Affected 5.x, 4.5.x Fixed in — No fix listed CNA
Telco Cloud Platform VendorVMware Affected 5.x, 4.x, 3.x, 2.x Fixed in — No fix listed CNA
Telco Cloud Infrastructure VendorVMware Affected 3.x, 2.x Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:o:vmware:esxi::::::::	—	—	VMware

cpe:2.3:o:vmware:esxi:*:*:*:*:*:*:*:* Versions — — ·VMware

Remediation

Fix · CNA ESXi (VMware) Fixed in ESXi80U3se-24659227, ESXi70U3sv-24723868

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-05-20
VMware ESXi ESXi70U3sv-24723868, ESXi80U3se-24659227
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2025-27474 Denial-of-service in VMware ESXiPriority LOW 24
- TI-2025-27475 VMware ESXi and vCenter Server Reflected Cross Site Scripting (XSS) VulnerabilityPriority LOW 22
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-41226
2026-10-03 Alias added: GHSA-jfjv-vw9w-9w8v

References

Other 1

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25717

TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8

See all 1181 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences