VMware vCenter & NSX High-Severity Vulnerabilities Advisory (CVE-2025-41250/251/252)

Key Information Vulnerability Overview Announcement ID: VMSA-2025-0016 Product: VMware vCenter and NSX CVE IDs: CVE-2025-41250, CVE-2025-41251, CVE-2025-41252 Severity: High (CVSS Base Score: 9.8) Release Date: September 28, 2023 Affected Products VMware Cloud Foundation VMware HCX VMware vCenter Server VMware NSX-T Data Center Vulnerability Details 1. vCenter SMTP Header Injection Vulnerability (CVE-2025-41250) - Description: Attackers can exploit this vulnerability by injecting malicious content into SMTP headers. - Affected Versions: vCenter Server 7.x, 6.x, 5.x - Remediation: Upgrade to the latest version or apply the available patch. 2. NSX Weak Password Recovery Mechanism Vulnerability (CVE-2025-41251) - Description: Attackers can exploit a weak password recovery mechanism to gain unauthorized access. - Affected Versions: NSX-T Data Center 3.x, 2.x - Remediation: Upgrade to the latest version or apply the available patch. 3. NSX Username Enumeration Vulnerability (CVE-2025-41252) - Description: Attackers can enumerate valid usernames by exploiting this vulnerability. - Affected Versions: NSX-T Data Center 3.x, 2.x - Remediation: Upgrade to the latest version or apply the available patch. Reference Links Provides multiple links to documentation and updates for related products to help further understand and remediate the vulnerabilities. Contact Information Email address provided for contacting VMware’s security team.

Goal Reached Thanks to every supporter — we hit 100%!

VMware vCenter & NSX High-Severity Vulnerabilities Advisory (CVE-2025-41250/251/252)