Broadcom has released important security updates for VMware Cloud Foundation, addressing three privately reported vulnerabilities that could allow attackers to access internal services, sensitive information, or perform unauthorized actions. These flaws—tracked as CVE-2025-41229, CVE-2025-41230, and CVE-2025-41231—affect versions of VMware Cloud Foundation prior to 5.2.1.2 and select 4.5.x releases.
The firs vulnerability, tracked as CVE-2025-41229 and rated as “Important” with a CVSSv3 base score of 8.2, could allow a malicious actor with network access to port 443 on VMware Cloud Foundation to “access certain internal services”. This means an attacker could potentially navigate through directories and access sensitive files they shouldn’t be able to reach.
Also deemed “Important” with a CVSSv3 base score of 7.5, the second flaw (CVE-2025-41230) could enable a malicious actor with network access to port 443 to “gain access to sensitive information via an endpoint“. This type of vulnerability can lead to the exposure of confidential data.
Finally, with an “Important” severity rating and a CVSSv3 base score of 7.3, the CVE-2025-41231 vulnerability could allow a malicious actor with access to the VMware Cloud Foundation appliance to “perform certain unauthorised actions and access limited sensitive information“. This highlights the risk of attackers bypassing security controls and performing actions they are not authorized to do.
All three issues were responsibly reported by Gustavo Bonito of the NATO Cyber Security Centre (NCSC).
For VMware Cloud Foundation version 5.x, the fixed version is 5.2.1.2. For those running VMware Cloud Foundation 4.5.x, the necessary update is KB398008.
