CVE-2025-41246 Improper authorisation vulnerability
Authenticated non-admin users on a guest VM can access other guest VMs due to improper authorization checks in VMware Tools.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-41246?
CVE-2025-41246 is a high-severity missing authorization vulnerability in VMware Tools, published on 29 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls. A malicious actor with non-administrative privileges on a guest VM, who is already authenticated through vCenter or ESX may exploit this issue to access other guest VMs. Successful exploitation requires knowledge of credentials of the targeted VMs and vCenter or ESX.
Weakness: CWE-863
Which versions are affected by CVE-2025-41246?
How do I fix CVE-2025-41246?
No fix has been published for CVE-2025-41246 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-41246 being exploited?
There is no known exploitation of CVE-2025-41246 in the wild and no public exploit code.
Sources
Also known as GHSA-8c4m-2wpp-9qmh.