PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-41236 Rockwell Automation CVE debrief

CVE-2025-41236 is a critical integer-overflow vulnerability in VMware’s VMXNET3 virtual network adapter. CISA’s Rockwell Automation advisory maps the issue to multiple Rockwell Automation VMware-based product families and directs customers to Broadcom’s remediation guidance. The stated impact is code execution on the host.

Vendor
Rockwell Automation
Product
Industrial Data Center (IDC) with VMware
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2025-07-31
Original CVE updated
2025-07-31
Advisory published
2025-07-31
Advisory updated
2025-07-31

Who should care

Administrators and operators of Rockwell Automation VMware-based offerings listed in the advisory—Industrial Data Center (IDC) with VMware, VersaVirtual Appliance (VVA) with VMware, Threat Detection Managed Services (TDMS) with VMware, Endpoint Protection Service with Rockwell Automation Proxy & VMware only, and Engineered and Integrated Solutions with VMware—as well as teams managing VMware ESXi, Workstation, or Fusion hosts referenced by the CVE description.

Technical summary

The advisory describes an integer-overflow in VMXNET3, a VMware virtual network adapter used in ESXi, Workstation, and Fusion. CISA assigns CVE-2025-41236 a CVSS v3.1 score of 9.3 (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating high impact once an attacker can trigger the flaw on the relevant host path. The CSAF ties the issue to five Rockwell Automation VMware-based product families and points users without Rockwell managed-services contracts to Broadcom’s fixed ESXi release notes, including 8.0 U3f, 8.0 U2e, and 7.0 U3w.

Defensive priority

Immediate

Recommended defensive actions

  • Inventory whether any of the Rockwell Automation VMware-based product families named in the advisory are deployed in your environment.
  • If you have an active Rockwell Automation Infrastructure Managed Service or Threat Detection Managed Service contract, coordinate remediation with Rockwell Automation.
  • If you do not have a Rockwell managed-services contract, follow the Broadcom advisories referenced in the CSAF and move to the corrected VMware releases cited there.
  • Review VMware host patch status for the ESXi 8.0 U3f, 8.0 U2e, and 7.0 U3w release lines referenced by the advisory, as applicable to your environment.
  • If immediate upgrading is not possible, apply the defensive best practices referenced by Rockwell Automation and CISA for industrial/managed environments.
  • Track the CISA advisory ICSA-25-212-02 and the official CVE/NVD records for any updates or clarifications.

Evidence notes

All statements are grounded in the supplied CISA CSAF source item published 2025-07-31 and the official CVE/NVD links. The source description states the VMXNET3 integer-overflow condition and host code-execution impact; the remediation section maps five Rockwell Automation VMware-based product families and references Broadcom fix pages. No exploit steps or unsupported version claims are included.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-41236 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-41236

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-41236 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-41236

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-212-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-212-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.