CVE-2025-41246
Improper authorisation vulnerability
HIGH 7.6
At a glance
- Source
- NVD
- EPSS
- EPSS 0.28 % · percentile 20 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- vmware
- NVD status
- Deferred
Description
VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this issue to access other guest VMs. Successful exploitation requires knowledge of credentials of the targeted VMs and vCenter or ESX.
Weaknesses (CWE)
- CWE-863 — Incorrect Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.6 | CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H | vmware |
| CVSS 3.1 | HIGH 7.6 | CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H | NVD · security@vmware.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-31579
- GCVE · GCVE-0-2025-41246
CERT-FR advisories
- CERTFR-2025-AVI-0832 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| VMware · Tools | affected 13.x.x.x < 13.0.5.0 ; affected 12.x.x < 12.5.4 ; affected 11.x.x |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |