Vulnerability Intelligence Report
Header injection vulnerability
CVE-2025-41250
VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks.
No Active Exploit Signals
CVSS Base Score
8.5
HIGH
Exploitability:3.2
Impact Score:4.8
EPSS Probability:0.62%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-77 ↗CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| VMware | vCenter | 8.0 < 8.0 U3g (affected), 7.0 < 7.0 U3w (affected) |
| VMware | Cloud Foundation | 9.x.x.x < 9.0.1.0 (affected), 5.x < 5.2.2 (affected), 4.5.x (affected) |
| VMware | Telco Cloud Platform | 5.x, 4.x, 3.x, 2.x (affected) |
| VMware | Telco Cloud Infrastructure | 3.x, 2.x (affected) |
| VMware | vSphere Foundation | 9.x.x.x < 9.0.1.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.623%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VMware by Broadcom · Vendor · USA |
| Reserved | 2025-04-16T09:30:25 |
| Published | 2025-09-29T17:44:27 |
| Patch Date | 2025-09-29 |
| Last Updated | 2026-02-26T17:47:51 |
Community Chatter & Buzz