Improper Authorization in VMware Tools for Windows Affects User Access Control

CVE-2025-41246

What is CVE-2025-41246?

VMware Tools for Windows contains an improper authorization vulnerability stemming from its handling of user access controls. Authenticated users with non-administrative privileges on a guest VM, through vCenter or ESX, can exploit this issue to gain unauthorized access to other guest VMs. Successful exploitation necessitates knowledge of the targeted VMs' credentials and vCenter or ESX, allowing a potential attacker to compromise user access controls and navigate within the environment.

References