CVE-2025-41246

HighCVSS 7.6/10Last modified Oct 9, 2026

Description

VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this issue to access other guest VMs. Successful exploitation requires knowledge of credentials of the targeted VMs and vCenter or ESX.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
VMware	Tools	>= 13.x.x.x, < 13.0.5.0; >= 12.x.x, < 12.5.4; 11.x.x

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149

Timeline

Published: Sep 29, 2025
Last modified: Oct 9, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-412487.5The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameter CVE-2025-412497.5The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a paramete CVE-2025-41259.8Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitra CVE-2025-412508.5VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has perm CVE-2025-412518.1VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid CVE-2025-412527.5Description: VMware NSX contains a username enumeration vulnerability. An unauthenticated malicious actor may exploit this to enumerate vali CVE-2025-412537.5The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system pr CVE-2025-412544.3STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages. Affected Sp CVE-2025-412558.0Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installi CVE-2025-412567.4Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), since the certificate fi CVE-2025-412574.8Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined wi CVE-2025-412588.0LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authenti