CVE-2025-41246

published 2025-09-29

CVE-2025-41246: VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with…

Priority P3 41 high 7.6 CVSS 3.1

AV A AC H PR H UI N S C C H I H A H

VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this issue to access other guest VMs. Successful exploitation requires knowledge of credentials of the targeted VMs and vCenter or ESX.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
vmware	tools	—	—
vmware	tools	>= 12.x.x < 12.5.4	12.5.4
vmware	tools	>= 13.x.x.x < 13.0.5.0	13.0.5.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-863