VMware vCenter and NSX Flaws Allow Hackers to Enumerate Usernames

According to Broadcom, three key vulnerabilities affecting VMware vCenter Server and NSX products were addressed in the VMSA-2025-0016 advisory, including an SMTP header injection in vCenter (CVE-2025-41250) and two NSX username enumeration flaws (CVE-2025-41251 and CVE-2025-41252). All three are rated in the Important severity range with CVSSv3 scores between 7.5 and 8.5, and the affected products include vCenter Server, Cloud Foundation, NSX, NSX-T and Telco Cloud.

The vCenter issue allows any user with permission to create scheduled tasks to manipulate notification emails, while the NSX flaws enable unauthenticated enumeration of valid usernames via a weak password recovery mechanism and login-response timing differences. Broadcom credits Per von Zweigbergk and the U.S.

National Security Agency for responsibly reporting these issues, and the advisory states there are no workarounds aside from applying patches promptly, since the NSX enumeration flaws can be chained with automated tools to build user lists within minutes. Administrators are urged to update all supported VMware Cloud Foundation, vSphere, vCenter Server and Telco Cloud releases and consult the official advisory for patching guidance. September 30, 2025.