VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper input validation. A malicious actor with network access to the login page of certain ESXi host or vCenter Server URL paths may exploit this issue to steal cookies or redirect to malicious websites.

The version of VMware vCenter Server installed on the remote host is 8.0.x prior to 8.0 U3e. It is, therefore, affected by a vulnerability as referenced in the VMSA-2025-0010 advisory.

  - VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper     input validation. (CVE-2025-41228)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of VMware ESXi installed on the remote host is 7.0.x prior to 7.0 Update 3v or 8.0.x prior to 8.0 Update 3e. It is, therefore, affected by multiple vulnerabilities as referenced in the VMSA-2025-0010 advisory.

  - ESXi contains a denial-of-service vulnerability that occurs when performing a guest operation.     (CVE-2025-41226)

  - Workstation, Fusion and ESXi contain a denial-of-service vulnerability due to certain guest options.     (CVE-2025-41227)

  - VMware ESXi and vCenter Server contain a reflected cross-site scripting vulnerability due to improper     input validation. (CVE-2025-41228)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VMware Workstation installed on the remote host is 17.0.x prior to 17.6.3. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 13.0.x prior to 13.6.3. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
237248	VMware vCenter Server 8.0 < 8.0 U3e Server Reflected XSS (CVE-2025-41228) (VMSA-2025-0010)	Nessus	Misc.	Remote	high
237246	VMware ESXi 7.0 / 8.0 Multiple Vulenerabilities (VMSA-2025-0010)	Nessus	Misc.	Remote	medium
236962	VMware Workstation 17.0.x < 17.6.3 Multiple Vulnerabilities (VMSA-2025-0010)	Nessus	General	Local	medium
236961	VMware Fusion 13.0.x < 13.6.3 Multiple Vulnerabilities (VMSA-2025-0010)	Nessus	MacOS X Local Security Checks	Local	medium

Detections

Analytics

CVE-2025-41228

medium

Tenable Plugins

high

medium

medium

medium