Broadcom fixes high-severity VMware NSX bugs reported by NSA

Broadcom has released security updates to patch two high-severity VMware NSX vulnerabilities reported by the NSA, affecting VMware NSX within VMware Cloud Foundation.

The first flaw, CVE-2025-41251, stems from a weakness in the password recovery mechanism that could let unauthenticated attackers enumerate valid usernames, potentially aiding brute-force attacks; the second, CVE-2025-41252, is a username enumeration vulnerability that could be exploited by unauthenticated threat actors to identify valid usernames and attempt unauthorized access.

According to Broadcom in a Monday security advisory, the company also patched a high-severity SMTP header injection vulnerability, CVE-2025-41250, in VMware vCenter, which could allow manipulation of notification emails by users with non-administrative privileges. In a separate advisory, Broadcom disclosed three more flaws in VMware Aria Operations and VMware Tools (CVE-2025-41244, CVE-2025-41245, CVE-2025-41246) that could escalate privileges to root, steal credentials, or access other guest VMs.

Earlier in the year, Broadcom also fixed four VMware zero-days exploited at Pwn2Own Berlin 2025 and three actively exploited VMware zero days (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226).