CVE-2025-41238
✓ Confirmed 0-Day
Triaged: March 5, 2026
2 articles
EPSS Score
Source: FIRST.org · 2026-05-24
0.12%
probability
This CVE has a 0.12% probability
of being exploited in the next 30 days.
0%
Top 29.9th percentile of all CVEs
100%
CVSS score unavailable
Neither CIRCL nor NVD returned a CVSS score for this CVE.
View on VulnerabilityLookup ↗
Attack Intelligence
VMware fixes four ESXi zero-day bugs exploited at Pwn2Own Berlin
BleepingComputer
Jul 17, 2025
Security Advisory 2025-026
CERT-EU
Jul 18, 2025
Signal Intelligence
Confidence
92%
EPSS
0.12%
Mentions
2
Last Seen
Jul 18, 2025
CNA Information
Analyst Note
CVE-2025-41238 is explicitly named as a zero-day exploited at Pwn2Own Berlin, with VMware releasing a patch in response to active exploitation. The CVE is recent (2025), and the BleepingComputer article directly states it as one of four ESXi zero-day bugs exploited at the security conference, confirming in-the-wild exploitation tied to patch release.
Threat Actors 2
Hacking Team
apt_group
🇮🇹 IT
The White Company
apt_group
Information theft and espionage
🇨🇳 CN
Triage Info
Decided atMar 05, 2026