VMware Vsphere Foundation vulnerabilities

5 CVEs affecting VMware Vsphere Foundation, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-41709, published 2026-07-30.

More from VMware.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-41250, published 2025-09-29. High severity, CVSS 8.5. EPSS: 0.6% chance of exploitation in the next 30 days. VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate…
• CVE-2025-41237, published 2025-07-15. Critical severity, CVSS 9.3. EPSS: 0.5% chance of exploitation in the next 30 days. VMware ESXi, Workstation, and Fusion contain an integer-underflow in VMCI (Virtual Machine Communication Interface) that leads to an out-of-bounds write. A malicious actor with local administrative…
• CVE-2026-41703, published 2026-07-30. High severity, CVSS 7.6. EPSS: 0.4% chance of exploitation in the next 30 days. VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to…
• CVE-2026-41709, published 2026-07-30. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
• CVE-2026-47876, published 2026-07-30. Critical severity, CVSS 9.3. EPSS: 0.2% chance of exploitation in the next 30 days. VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual…