Introduction
Attackers can remotely enumerate valid usernames on unpatched VMware NSX systems, then use that list for targeted credential brute-force campaigns. The vulnerability is tracked as CVE-2025-41251 and was reported by the National Security Agency. It affects a wide range of NSX and VMware Cloud Foundation deployments, has a CVSSv3 score of 8.1, and has no available workarounds.
About VMware NSX: VMware, now under Broadcom, sells virtualization and network security products. NSX is its network virtualization platform, widely used in enterprise and cloud environments for microsegmentation and network policy enforcement. Because NSX is integrated into critical infrastructure and cloud stacks, a flaw in it can have broad impact.
Technical Information
CVE-2025-41251 comes from a weak password recovery mechanism in VMware NSX. A remote, unauthenticated attacker can submit password recovery requests and tell from the system's response whether a username exists. The flaw is classified as CWE-640 (Weak Password Recovery Mechanism for Forgotten Password).
The password recovery endpoint responds differently depending on whether the submitted username is valid. The differences may include distinct error messages, HTTP status codes, or subtle timing variations. An attacker can automate requests from a list of candidate usernames, note which ones get a response indicating a valid account, and build a comprehensive list of valid usernames for the target NSX deployment.
With that list in hand, credential brute-force and password spraying attacks become much more efficient. The vulnerability is reachable over the network and needs no authentication, so internet-exposed NSX management interfaces are at particular risk.
Affected Systems and Versions
The following products and versions are affected:
- VMware NSX 9.x.x.x
- VMware NSX 4.2.x
- VMware NSX 4.1.x
- VMware NSX 4.0.x
- NSX-T 3.x
- VMware Cloud Foundation (with NSX) 5.x
- VMware Cloud Foundation (with NSX) 4.5.x
Fixed versions:
- NSX 9.0.1.0
- NSX 4.2.2.2 or 4.2.3.1
- NSX 4.1.2.7
- NSX-T 3.2.4.3
- VMware Cloud Foundation: Apply the CCF async patch (KB88287)
No effective workarounds exist. Every configuration running one of the vulnerable versions above is at risk.
Vendor Security History
VMware has a history of critical vulnerabilities in its infrastructure products, including NSX and ESXi. Past issues include authentication bypasses, remote code execution, and input validation flaws. The vendor typically issues coordinated advisories and patches, but the frequency of high-severity vulnerabilities has drawn increased scrutiny from the security community. Broadcom's acquisition has also changed VMware's support and vulnerability management processes.
