VMware vCenter Denial-of-Service via Guest OS Customization API
CVE-2025-41241 Published on July 29, 2025
Denial-of-service vulnerability
VMware vCenter contains a denial-of-service vulnerability. A malicious actor who is authenticated through vCenter and has permission to perform API calls for guest OS customisation may trigger this vulnerability to create a denial-of-service condition.
Vulnerability Analysis
CVE-2025-41241 can be exploited with network access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
Improper Check for Unusual or Exceptional Conditions
The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.
Products Associated with CVE-2025-41241
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-41241 are published in VMware Vcenter Server:
Affected Versions
VMware vCenter:- Version 8.0 and below 8.0 U3g is affected.
- Version 7.0 and below 7.0 U3v is affected.
- Version 5.x, 4.5.x is affected.
- Version 5.x, 2.x is affected.
- Version 2.x is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.