Critical Vulnerability in VMware Cloud Foundation Exposes Sensitive Data to Attackers

Broadcom’s VMware division has disclosed three significant security vulnerabilities in its Cloud Foundation platform that could allow attackers to gain unauthorized access to sensitive information and internal services.

The advisory, published today (May 20, 2025), details vulnerabilities with CVSS scores ranging from 7.3 to 8.2, all rated as “Important” severity.

The flaws affect both VMware Cloud Foundation 4.5.x and 5.x versions and require immediate patching as no workarounds are available.

The security advisory (VMSA-2025-0009) reveals three distinct vulnerabilities that pose significant risks to enterprise environments using the affected VMware products.

The most severe vulnerability, CVE-2025-41229, received a CVSS score of 8.2 and involves a directory traversal vulnerability that could allow unauthorized access to internal services.

The second vulnerability, CVE-2025-41230, carries a CVSS score of 7.5 and is classified as an information disclosure vulnerability.

This flaw could expose sensitive information to attackers with network access to the platform.

The third vulnerability, CVE-2025-41231, with a CVSS score of 7.3, involves missing authorization controls.

This could allow malicious actors with access to VMware Cloud Foundation appliances to perform unauthorized actions and access sensitive information without proper authentication.

All three vulnerabilities were reported privately to VMware by Gustavo Bonito of the NATO Cyber Security Centre (NCSC), demonstrating continued collaboration between security researchers and software vendors to address critical security issues.

Attack Vectors Allow Unauthorized Access Services

According to the advisory, attackers targeting CVE-2025-41229 and CVE-2025-41230 only need network access to port 443 on affected VMware Cloud Foundation deployments to potentially exploit these vulnerabilities.

This relatively low barrier to entry increases the risk profile substantially, as many organizations expose management interfaces to facilitate remote administration.

The directory traversal vulnerability (CVE-2025-41229) could allow attackers to navigate beyond intended directories and access internal services that should be restricted.

Meanwhile, the information disclosure vulnerability (CVE-2025-41230) provides a path for malicious actors to access sensitive information through a specific endpoint.

The missing authorization vulnerability (CVE-2025-41231) requires the attacker to already have access to the VMware Cloud Foundation appliance but could then allow them to perform unauthorized actions and access sensitive information beyond their privilege level.

Patching Recommended as No Workarounds

VMware has emphasized that no workarounds exist for these vulnerabilities, making patching the only effective mitigation strategy.

For VMware Cloud Foundation 5.x installations, administrators should immediately update to version 5.2.1.2.

According to the Report, Organizations running VMware Cloud Foundation 4.5.x should follow the guidance provided in knowledge base article KB398008.

The technical details published in the advisory include CVSS vector strings that provide additional context about the attack complexity and potential impact.

For example, the directory traversal vulnerability (CVE-2025-41229) has a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, indicating it can be exploited remotely with low complexity, requires no privileges or user interaction, and primarily impacts confidentiality.

Security experts recommend organizations running VMware Cloud Foundation to prioritize these patches in their maintenance cycles and to implement network segmentation where possible to reduce exposure until patches can be fully deployed.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!