CVE-2025-41226: VMware Cloud Foundation

Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days.

VMware ESXi contains a denial-of-service vulnerability that occurs when performing a guest operation. A malicious actor with guest operation privileges on a VM, who is already authenticated through vCenter Server or ESXi may trigger this issue to create a denial-of-service condition of guest VMs with VMware Tools running and guest operations enabled.

Affected products

• VMware Cloud Foundation
• VMware ESXi
• VMware Telco Cloud Infrastructure
• VMware Telco Cloud Platform

Published 2025-05-20. Last modified 2026-06-17.