CVE-2025-41250
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedVMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on vCenter who has permission to create scheduled tasks may be able to manipulate the notification emails sent for scheduled tasks.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceVMware vCenter contains an SMTP header injection vulnerability where an authenticated user with non-administrative privileges and scheduled task creation permission can manipulate notification emails sent for scheduled tasks. This allows injection of arbitrary SMTP headers, potentially enabling email spoofing or phishing attacks via the vCenter mail system.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Confirm vCenter installation and versionLocate the VMware vCenter Server installation and determine its installed version by accessing the vSphere Client About page or running 'vpxd -v' from the vCenter server command line.Affected if The installed vCenter version falls within the range of versions known to be affected by CVE-2025-41250.
-
Identify users with scheduled task creation permissionsAccess the vSphere Client Administration section and review role assignments. Navigate to Access Control > Users and Groups (or use the 'vimsh' command) to list all users and their assigned roles. Specifically identify roles that include the 'Scheduled Task: Create' privilege.Affected if Any user account with non-administrative privileges is assigned a role containing the scheduled task creation permission.
-
Verify email notification settings for scheduled tasksIn the vSphere Client, go to Administration > Settings > Mail Configuration (or equivalent). Check if SMTP outgoing mail is enabled and configured for vCenter server notifications.Affected if SMTP notifications are enabled and configured, allowing vCenter to send email for scheduled task events.
-
Review existing scheduled tasks for notification triggersUse the vSphere Client to list all scheduled tasks (Menu > Tasks & Events > Scheduled Tasks). Examine each task's configuration to see which ones are set to send email notifications upon completion or failure.Affected if Any scheduled task is configured to send notification emails, providing a potential vector for SMTP header injection.
-
Audit recent notification emails for anomaliesReview mail server logs or capture outbound emails from the vCenter server. Look for emails with unexpected headers, additional recipients, or modified sender addresses that were sent through vCenter scheduled task notifications.Affected if Emails originating from vCenter scheduled task notifications contain unexpected SMTP headers or were sent to unintended recipients.
Your environment is affected if you run a vulnerable vCenter version, have users with scheduled task creation permissions (even non-administrative), and have SMTP notifications enabled for scheduled tasks.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataApply VMware security patches for CVE-2025-41250 when released. Until then, restrict scheduled task creation permissions to only trusted administrators and monitor for suspicious email patterns from vCenter notifications.
- Consultation6.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,368.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2025-41250 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2025-41250 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data