CVE-2025-41246
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-09-29

Last updated on: 2025-09-29

Assigner: VMware

Description
VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this issue to access other guest VMs. Successful exploitation requires knowledge of credentials of the targeted VMs and vCenter or ESX.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-09-29
Last Modified
2025-09-29
Generated
2026-07-06
AI Q&A
2025-09-29
EPSS Evaluated
2026-07-05
NVD
CVE-2025-41246

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vmware vmware_tools *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in VMware Tools for Windows is due to improper authorization in handling user access controls. A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX, can exploit this issue to access other guest VMs. Exploitation requires knowledge of credentials for the targeted VMs and vCenter or ESX.

Impact Analysis

The vulnerability can allow a malicious user with limited privileges on one guest VM to access other guest VMs, potentially leading to unauthorized access to sensitive data, disruption of services, or further compromise within the virtual environment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-41246. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart