CVE-2025-41226

Guest Operations Denial-of-Service Vulnerability

En bref

Sévérité
MEDIUM 6.8
EPSS
EPSS 0.24 % · centile 15 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
vmware
Statut NVD
Deferred

Description

VMware ESXi contains a denial-of-service vulnerability that occurs when performing a guest operation. A malicious actor with guest operation privileges on a VM, who is already authenticated through vCenter Server or ESXi may trigger this issue to create a denial-of-service condition of guest VMs with VMware Tools running and guest operations enabled.

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 6.8CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:Hvmware
CVSS 3.1MEDIUM 6.8CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HNVD · security@vmware.com (Secondary)

Faiblesses (CWE)

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
VMware · ESXiaffected 8.0 < ESXi80U3se-24659227 ; affected 7.0 < ESXi70U3sv-24723868
VMware · Cloud Foundationaffected 5.x, 4.5.x
VMware · Telco Cloud Platformaffected 5.x, 4.x, 3.x, 2.x
VMware · Telco Cloud Infrastructureaffected 3.x, 2.x

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD