CVE-2025-41231: VMware Cloud Foundation

High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days.

VMware Cloud Foundation contains a missing authorisation vulnerability. A malicious actor with access to VMware Cloud Foundation appliance may be able to perform certain unauthorised actions and access limited sensitive information.

Affected products

• VMware Cloud Foundation: from 4.5, before 4.5.2 (fixed in 4.5.2); from 5.0, before 5.2.1.2 (fixed in 5.2.1.2)

Published 2025-05-20. Last modified 2026-06-17.