Introduction
Attackers can remotely enumerate valid usernames in VMware NSX environments without authenticating. That gives them a head start on reconnaissance and targeted credential attacks. The vulnerability, tracked as CVE-2025-41252, affects a wide range of NSX and VMware Cloud Foundation deployments. The National Security Agency reported it in September 2025.
VMware NSX is a network virtualization and security platform, widely used in enterprise and cloud data centers for micro-segmentation and network automation. Because so much infrastructure depends on it, a vulnerability in NSX can have broad operational and security impact across industries.
Technical Information
CVE-2025-41252 is a username enumeration vulnerability classified under CWE-203 (Observable Discrepancy). The flaw is in the authentication logic of the VMware NSX management interfaces. When an unauthenticated user submits a username to the login endpoint, the response differs depending on whether that username exists. The difference can show up in error messages, in HTTP status codes, or in small timing differences.
An attacker can script requests from a list of candidate usernames and compare the responses to reliably tell which ones are valid. The result is a list of real accounts that can then be targeted with credential stuffing, brute force, or phishing. The vulnerability affects both web and API-based authentication endpoints in NSX and related products.
No public code snippets or proof of concept have been released for this vulnerability. The root cause is improper neutralization of differences in authentication error handling, which lets unauthenticated users learn whether an account exists.
Affected Systems and Versions
The following products and versions are confirmed vulnerable:
- VMware NSX 9.x.x.x
- VMware NSX 4.2.x
- VMware NSX 4.1.x
- VMware NSX 4.0.x
- NSX-T 3.x
- VMware Cloud Foundation (with NSX) 5.x
- VMware Cloud Foundation (with NSX) 4.5.x
All configurations with exposed NSX management interfaces are affected.
Vendor Security History
VMware has had multiple high-impact vulnerabilities in its NSX and ESXi products across 2024 and 2025. Several NSX vulnerabilities were disclosed in 2025, and earlier in 2025 attackers actively exploited three zero-day flaws in ESXi, Workstation, and Fusion. VMware generally publishes advisories and patches promptly, but critical issues keep recurring in its core products, a sign that security problems in virtualization software are not going away.
