Broadcom-owned VMware released urgent patches on Tuesday to address two sets of vulnerabilities in its core infrastructure software. These flaws could lead to data leakage,
command execution, and denial-of-service attacks, and there are no temporary workarounds available.
The virtualization company published two separate advisories covering at least seven vulnerabilities affecting VMware Cloud Foundation, VMware ESXi, vCenter Server, Workstation, and Fusion.
The first and more critical advisory, VMSA-2025-0009, attributes the discovery of three security issues in VMware Cloud Foundation to the NATO Cyber Security Centre. The most severe flaw, tracked as CVE-2025-41229, is a directory traversal vulnerability with a CVSS score of 8.2 out of 10.
VMware warned that attackers with network access to port 443 on VMware Cloud Foundation could exploit this issue to reach certain internal services.
Additional patches were released to address an information disclosure vulnerability (CVSS 7.5) and a missing authorization issue (CVSS 7.3) in VMware Cloud Foundation. This product is widely used by organizations to manage and operate private cloud environments.
Customers are strongly encouraged to upgrade to VMware Cloud Foundation version 5.2.1.2.
In a second advisory, VMSA-2025-0010, VMware detailed four more vulnerabilities affecting ESXi, vCenter Server, Workstation, and Fusion.
The most serious of these is CVE-2025-41225, an authenticated command execution vulnerability in vCenter that has a CVSS score of 8.8. VMware noted that attackers with the ability to create or modify alarms could use this flaw to execute arbitrary commands on the management plane.
The remaining vulnerabilities include two denial-of-service issues (CVSS scores 6.8 and 5.5) and a reflected cross-site scripting flaw affecting both ESXi and vCenter (CVSS score 4.3).
VMware stated that upgrading is the only solution, as there are no mitigations available. There is currently no evidence of these vulnerabilities being exploited in the wild.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
