Broadcom Fixes Multiple VMware vCenter and NSX Vulnerabilities

On 30 September 2025, Broadcom released patches for three vulnerabilities affecting VMware vCenter Server and VMware NSX, rated Important. The flaws, CVE-2025-41250, CVE-2025-41251, and CVE-2025-41252, could allow a malicious actor to manipulate system notifications or enumerate usernames, increasing the risk of brute-force or unauthorized access attempts.

CVE-2025-41250 concerns an SMTP header injection in vCenter, where a non-administrative user with permission to create scheduled tasks could influence notification emails; fixes are available in vCenter 9.0.1.0, 8.0 U3g, and 7.0 U3w. CVE-2025-41251 relates to a weak password recovery mechanism in NSX, enabling unauthenticated username enumeration that could fuel brute-force attempts, with updates in NSX 9.0.1.0, 4.2.2.2, 4.2.3.1, and 4.1.2.7.

The third flaw, CVE-2025-41252, is a related NSX username enumeration vulnerability; fixes are included alongside CVE-2025-41251. Affected products include VMware vCenter Server (7.0, 8.0, 9.x), VMware NSX (3.x–5.x, 9.x), VMware Cloud Foundation, VMware vSphere Foundation, and related VMware platforms; Broadcom stresses that there are no workarounds and urges immediate patching, with async guidance in KB88287 and KB411508. according to Broadcom.