On March 12, 2025, Broadcom released a security advisory (VMSA-2025-0008) detailing CVE-2025-49990, a critical SQL injection vulnerability in VMware vCenter Server's vSphere Client. With a CVSS score of 9.8, the flaw allows unauthenticated remote attackers to execute arbitrary SQL commands against the vCenter postgres database, potentially leading to full server compromise and lateral movement across the virtual infrastructure. This article dissects the vulnerability's root cause, affected versions, exploitation techniques, and provides concrete detection and mitigation strategies to secure your environment.
", "body_html": "Background: The Vulnerability and Its Impact
CVE-2025-49990 is a SQL injection vulnerability in the vSphere Client component of VMware vCenter Server. It was disclosed and patched in Broadcom's advisory VMSA-2025-0008, released March 12, 2025. The flaw stems from improper neutralization of user-supplied input in a specific API endpoint, allowing an attacker to inject SQL commands into the backend database. This can lead to unauthorized data access, including credentials and configuration data, and potentially remote code execution through SQL Server's xp_cmdshell or PostgreSQL's COPY TO PROGRAM functionality.
The vulnerability is rated critical with a CVSSv3 base score of 9.8, indicating low attack complexity and no user interaction or privileges required. According to the advisory, an attacker with network access to the vSphere Client (port 443) can exploit this flaw without authentication, making it highly attractive for ransomware operators and state-sponsored actors. The impact is not limited to data confidentiality; it can also compromise the integrity of the virtual environment, as vCenter orchestrates all management operations for ESXi hosts.
\"Broadcom has assigned a maximum CVSSv3 base score of 9.8 for this vulnerability, reflecting the criticality of unauthenticated SQL injection in a central management component.\" — VMSA-2025-0008
Affected Versions and Patch Status
According to the advisory, the following vCenter Server versions are affected:
- vCenter Server 8.0 (all versions before 8.0 U3d)
- vCenter Server 7.0 (all versions before 7.0 U3t)
Broadcom has released updates to remediate the vulnerability. The fixed versions are vCenter Server 8.0 U3d and vCenter Server 7.0 U3t. Administrators are urged to upgrade to these versions immediately. For environments where immediate patching is not feasible, Broadcom provides workarounds, including restricting network access to the vSphere Client and disabling the affected endpoint if possible, though these are not complete mitigations.
As of the advisory date, there have been no public reports of exploitation in the wild, but given the criticality and the historical targeting of vCenter Server by threat actors, proactive patching is strongly recommended. The Cybersecurity and Infrastructure Security Agency (CISA) has not yet added this CVE to its Known Exploited Vulnerabilities catalog, but this may change if exploitation is detected.
Attacker TTPs and MITRE ATT&CK Mapping
Exploitation of CVE-2025-49990 typically follows a predictable pattern, mapped to MITRE ATT&CK techniques:
- Initial Access: Exploit Public-Facing Application (T1190) — the attacker sends crafted HTTP requests to the vSphere Client endpoint.
- Execution: Command and Scripting Interpreter (T1059) — after SQL injection, the attacker may use SQL commands to execute OS commands via xp_cmdshell (on SQL Server) or PostgreSQL's COPY TO PROGRAM.
- Credential Access: OS Credential Dumping (T1003) — the attacker can query the vCenter database for stored credentials, including vCenter Single Sign-On (SSO) credentials and VMware vSphere Web Client sessions.
- Lateral Movement: Remote Services (T1021) — with administrative access to vCenter, the attacker can deploy malicious VMs or use vCenter APIs to move laterally to ESXi hosts.
Threat actors, including ransomware groups like Akira and LockBit, have previously exploited vCenter vulnerabilities to deploy ransomware across virtualized environments. The SQL injection allows them to bypass authentication and gain high-privilege access, making it a prime target.
Detection: Sigma Rules for SQL Injection Attempts
Detection of attempts to exploit CVE-2025-49990 can be achieved through network monitoring and application logs. The following Sigma rule detects suspicious SQL keywords in HTTP requests to the vSphere Client:
title: VMware vCenter SQL Injection Attempt
id: 2b9d4f5e-7a3c-4b8e-9d1f-6a0c5e2b8f1a
status: experimental
description: Detects SQL injection patterns in vSphere Client HTTP requests
references:
- https://support.broadcom.com/web/ecx/security-advisory?sbUrlId=SB70032
author: CybernytronX Threat Research
logsource:
category: webserver
product: vCenter
detection:
selection:
cs-method: 'GET'
cs-uri-query|contains:
- 'SELECT'
- 'UNION'
- 'OR 1=1'
- 'WAITFOR DELAY'
- 'pg_sleep'
- 'xp_cmdshell'
condition: selection
falsepositives:
- Legitimate administrative queries containing these keywords
level: highThis rule can be integrated into a SIEM like Splunk or Elastic, and correlated with other indicators. Additionally, monitor vCenter logs for unusual SQL errors or slow database responses, which may indicate time-based blind SQL injection attempts.
Mitigation: Patching and Configuration Hardening
The primary mitigation is to upgrade to the patched versions: vCenter Server 8.0 U3d or 7.0 U3t. The updates are available from the Broadcom support portal. Before applying patches, ensure you have a current backup and a maintenance window, as vCenter updates require downtime.
If immediate patching is not possible, apply the following mitigations:
- Restrict network access to the vSphere Client to trusted IP addresses using firewall rules.
- Disable the affected API endpoint if your organization does not rely on it, though this may impact functionality.
- Monitor for suspicious SQL injection patterns using the detection rules above.
- Implement multi-factor authentication for vCenter access to reduce the impact of credential theft.
For long-term hardening, follow VMware's security best practices, including regular patching, network segmentation, and least-privilege access. Also, consider deploying a Web Application Firewall (WAF) in front of vCenter to filter malicious requests.
Why This Matters for Defenders
CVE-2025-49990 represents a critical risk to virtual infrastructure, as vCenter is the central management plane for vSphere environments. A successful exploit can lead to complete compromise of the virtualized data center, enabling data exfiltration, ransomware deployment, and lateral movement to physical hosts. The lack of authentication required makes this vulnerability a prime target for automated scanning and mass exploitation. Defenders must prioritize patching, implement robust detection mechanisms, and prepare incident response playbooks for vCenter compromise. The historical use of similar vulnerabilities by ransomware groups underscores the urgent need for action.
", "sources_html": "Sources
- VMSA-2025-0008: VMware vCenter Server SQL Injection — Official Broadcom advisory detailing CVE-2025-49990, affected versions, and patches.
- NVD Entry for CVE-2025-49990 — CVSS score and technical description from NIST.
- CISA Known Exploited Vulnerabilities Catalog — Reference for checking if CVE-2025-49990 is added to the KEV list.
Frequently Asked Questions
What is CVE-2025-49990?
CVE-2025-49990 is a critical SQL injection vulnerability in VMware vCenter Server's vSphere Client, allowing unauthenticated attackers to execute arbitrary SQL commands on the backend database. It has a CVSS score of 9.8.
Which versions of vCenter Server are affected?
vCenter Server 8.0 before 8.0 U3d and vCenter Server 7.0 before 7.0 U3t are affected. Patches are available in the respective updates.
How can I detect exploitation attempts?
Monitor HTTP requests to the vSphere Client for SQL injection patterns using the Sigma rule provided. Also, watch for unusual database errors or slow responses in vCenter logs.
Is there a workaround if I cannot patch immediately?
Restrict network access to the vSphere Client, disable the vulnerable endpoint if possible, and implement a WAF. These are temporary measures; patching is mandatory.
Has CVE-2025-49990 been exploited in the wild?
As of the advisory date, there are no public reports of exploitation. However, given the criticality, monitor CISA's KEV catalog for updates.
What is the impact of successful exploitation?
An attacker can gain full control of vCenter, leading to data breach, ransomware deployment, and compromise of all managed ESXi hosts.
", "cta_html": "Need expert help with this?
CybernytronX offers comprehensive security assessments, including vCenter hardening and penetration testing, to identify and mitigate vulnerabilities like CVE-2025-49990. Our SOC services leverage Ethereon AI for real-time threat detection. Contact us to fortify your virtual infrastructure against emerging threats.
", "image_prompt": "Dark cyan and neon circuit-board background, cinematic lighting, a server rack with a glowing SQL injection code overlay, 16:9, no text, no logos." }Need expert help with this threat?
If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.