Broadcom-owned VMware on Tuesday rolled out urgent patches for two sets of flaws that expose its flagship infrastructure software to data leakage, command execution and denial-of-service attacks, with no temporary workarounds available.
The virtualization technology giant pushed out two separate bulletins documenting at least 7 vulnerabilities in the VMware Cloud Foundation, VMware ESXi, vCenter Server, Workstation, and Fusion product lines.
The more urgent advisory, VMSA-2025-0009, credits the NATO Cyber Security Centre for reporting three security defects in VMware Cloud Foundation. The highest-rated, CVE-2025-41229, is a directory-traversal issue that scores 8.2/10 on the CVSS scale.
“A malicious actor with network access to port 443 on VMware Cloud Foundation may exploit this issue to access certain internal services,” the company warned.
VMware also shipped patches for an information-disclosure bug (CVSS 7.5) and a missing-authorisation error (CVSS 7.3) in VMware Cloud Foundation, a product used by enterprises to build and manage private clouds.
Customers are urged to upgrade immediately to VMware Cloud Foundation 5.2.1.2
VMware also pushed out a second bulletin (VMSA-2025-0010) with documentation for four vulnerabilities across ESXi, vCenter Server, Workstation and Fusion.
The headline issue is CVE-2025-41225, an authenticated command-execution flaw in vCenter that carries a CVSS 8.8 rating. VMware warns that an attacker who can create or modify alarms can run arbitrary commands on the management plane.
The other three bugs include two denial-of-service conditions (CVSS 6.8 and 5.5) and a reflected XSS in both ESXi and vCenter (CVSS 4.3).
As with the Cloud Foundation flaws, VMware lists no mitigations beyond upgrading. There is no mention of in-the-wild exploits for any of these flaws.
Related: VMware Discloses Exploitation of Hard-to-Fix vCenter Server Flaw
Related: VMware Struggles to Fix Flaw Exploited at Chinese Hacking Contest
Related: VMware Patches RCE Flaw Found in Chinese Hacking Contest
Related: Microsoft Says Ransomware Gangs Exploiting VMware ESXi Flaw
