Denial-of-service in VMware vCenter
Priority LOW 20CWE-754Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
VMware vCenter contains a denial-of-service vulnerability. A malicious actor who is authenticated through vCenter and has permission to perform API calls for guest OS customisation may trigger this vulnerability to create a denial-of-service condition.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00338 27th percentileScored 2026-11-07
Fix Fixed vCenter (VMware): 8.0 U3g, 7.0 U3v
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | vCenter | 8.0 to before 8.0 U3g; 7.0 to before 7.0 U3v | 8.0 U3g, 7.0 U3v | Patch available | CNA |
| VMware | Cloud Foundation | 5.x, 4.5.x | — | No fix listed | CNA |
| VMware | Telco Cloud Platform | 5.x, 2.x | — | No fix listed | CNA |
| VMware | Telco Cloud Infrastructure | 2.x | — | No fix listed | CNA |
- vCenter VendorVMware Affected 8.0 to before 8.0 U3g; 7.0 to before 7.0 U3v Fixed in 8.0 U3g, 7.0 U3v Patch available CNA
- Cloud Foundation VendorVMware Affected 5.x, 4.5.x Fixed in — No fix listed CNA
- Telco Cloud Platform VendorVMware Affected 5.x, 2.x Fixed in — No fix listed CNA
- Telco Cloud Infrastructure VendorVMware Affected 2.x Fixed in — No fix listed CNA
Remediation
- Fix · CNA vCenter (VMware) Fixed in 8.0 U3g, 7.0 U3v
Timeline
- 2026-10-02 Threatist record created from CVE-2025-41241
- 2026-10-03 Alias added: GHSA-w9mx-hpxm-qx9w
References
More VMware vulnerabilities
- TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-41241 · CVE Program
- CVE-2025-41241 · NVD
- FIRST EPSS
- GHSA-w9mx-hpxm-qx9w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences