Header injection vulnerability
Priority MEDIUM 40CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-77.
Summary
VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00655 51st percentileScored 2026-11-07
Fix Fixed vCenter (VMware): 8.0 U3g, 7.0 U3wCloud Foundation (VMware): 9.0.1.0, 5.2.2+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | vCenter | 8.0 to before 8.0 U3g; 7.0 to before 7.0 U3w | 8.0 U3g, 7.0 U3w | Patch available | CNA |
| VMware | Cloud Foundation | 9.x.x.x to before 9.0.1.0; 5.x to before 5.2.2; 4.5.x | 9.0.1.0, 5.2.2 | Patch available | CNA |
| VMware | Telco Cloud Platform | 5.x, 4.x, 3.x, 2.x | — | No fix listed | CNA |
| VMware | Telco Cloud Infrastructure | 3.x, 2.x | — | No fix listed | CNA |
| VMware | vSphere Foundation | 9.x.x.x to before 9.0.1.0 | 9.0.1.0 | Patch available | CNA |
- vCenter VendorVMware Affected 8.0 to before 8.0 U3g; 7.0 to before 7.0 U3w Fixed in 8.0 U3g, 7.0 U3w Patch available CNA
- Cloud Foundation VendorVMware Affected 9.x.x.x to before 9.0.1.0; 5.x to before 5.2.2; 4.5.x Fixed in 9.0.1.0, 5.2.2 Patch available CNA
- Telco Cloud Platform VendorVMware Affected 5.x, 4.x, 3.x, 2.x Fixed in — No fix listed CNA
- Telco Cloud Infrastructure VendorVMware Affected 3.x, 2.x Fixed in — No fix listed CNA
- vSphere Foundation VendorVMware Affected 9.x.x.x to before 9.0.1.0 Fixed in 9.0.1.0 Patch available CNA
Remediation
- Fix · CNA vCenter (VMware) Fixed in 8.0 U3g, 7.0 U3w
- Fix · CNA Cloud Foundation (VMware) Fixed in 9.0.1.0, 5.2.2
- Fix · CNA vSphere Foundation (VMware) Fixed in 9.0.1.0
Timeline
- 2026-10-02 Threatist record created from CVE-2025-41250
- 2026-10-03 Alias added: GHSA-5qfp-g44c-j8xm
- 2026-10-19 EPSS moved to the 50th–90th percentile
References
More VMware vulnerabilities
- TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-41250 · CVE Program
- CVE-2025-41250 · NVD
- FIRST EPSS
- GHSA-5qfp-g44c-j8xm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences