Introduction
An attacker who can tamper with notifications from trusted infrastructure can use them for phishing, information disclosure, and lateral movement inside enterprise environments. VMware vCenter, a core management platform for virtualized data centers, has a high-severity SMTP header injection vulnerability tracked as CVE-2025-41250. An authenticated user with permission to create scheduled tasks can tamper with the notification emails vCenter sends, and that could enable a range of attacks.
About VMware vCenter: VMware makes virtualization and cloud infrastructure software, and vCenter Server is the central management tool for VMware environments. vCenter is widely deployed in enterprise data centers, where thousands of organizations use it to manage virtual machines, storage, and network resources.
Technical Information
CVE-2025-41250 is in vCenter's email notification system for scheduled tasks. When a user with the necessary permissions creates or modifies a scheduled task, vCenter generates notification emails. It puts user-controlled input into the headers of those emails without sufficient sanitization, and that is the vulnerability.
An attacker can exploit this by injecting carriage return and line feed (CRLF) sequences into the relevant input fields. For example, if the task name or description field is not sanitized, an attacker could submit input like:
TaskName\r\nBCC: [email protected]\r\nSubject: Malicious Subject
The email system would then read the injected content as new headers, so the attacker could add BCC recipients, change the subject, or manipulate the email in other ways. The root cause is that vCenter does not properly neutralize special elements when it builds email headers, which maps to CWE-77 (command injection). No public code snippets or proof of concept have been released for this vulnerability.
Affected Systems and Versions
- Product: VMware vCenter Server
- Vulnerable configurations: Systems where non-administrative users have permission to create scheduled tasks
- Specific affected versions: Not provided in the available briefing materials
Vendor Security History
VMware, now a Broadcom company, has a history of critical vulnerabilities in its virtualization management products, including command execution flaws (such as CVE-2025-41225) and authentication bypasses. VMware usually issues timely patches and detailed advisories. Even so, the frequency and impact of vulnerabilities in vCenter and related products remain a concern for security teams.
