VMware Vulnerabilities and Affected Products
Vulnerabilities associated with nsx.
Products
Clear product- Workstation54 vulnerabilities
- Fusion49 vulnerabilities
- ESXi33 vulnerabilities
- Cloud Foundation17 vulnerabilities
- cloud_foundation17 vulnerabilities
- Telco Cloud Platform17 vulnerabilities
- vCenter Server15 vulnerabilities
- VMware Aria Operations15 vulnerabilities
- Telco Cloud Infrastructure14 vulnerabilities
- VMware ESXi14 vulnerabilities
- Spring Framework12 vulnerabilities
- SALT11 vulnerabilities
- Horizon View Client for Windows9 vulnerabilities
- Avi Load Balancer8 vulnerabilities
- VMware Telco Cloud Platform8 vulnerabilities
- vSphere Foundation7 vulnerabilities
- Workstation Pro / Player6 vulnerabilities
- Workstation Pro/Player6 vulnerabilities
- Fusion Pro / Fusion5 vulnerabilities
- nsx5 vulnerabilities
- Spring AI5 vulnerabilities
- VMware Cloud Foundation5 vulnerabilities
- VMware Cloud Foundation (vCenter Server)5 vulnerabilities
- VMware Fusion5 vulnerabilities
- VMware vCenter Server (vCenter Server)5 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-41252HIGH | Username enumeration vulnerabilityDescription: VMware NSX contains a username enumeration vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially leading to unauthorized access attempts. Impact: Username enumeration → facilitates unauthorized access. Attack Vector: Remote, unauthenticated. Severity: Important. CVSSv3: 7.5 (High). Acknowledgments: Reported by the National Security Agency. Affected Products: * VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x * NSX-T… CWE-203Sep 29, 2025 | CVSS7.5v3.1 | EPSS0.878% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-41251HIGH | Weak password recovery vulnerabilityVMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks. Impact: Username enumeration → credential brute force risk. Attack Vector: Remote, unauthenticated. Severity: Important. CVSSv3: 8.1 (High). Acknowledgments: Reported by the National Security Agency. Affected Products:VMware NSX 9.x.x.x, 4.2.x, 4.1.x, 4.0.x NSX-T 3.x VMware Cloud Foundation (with NSX)… CWE-640Sep 29, 2025 | CVSS8.1v3.1 | EPSS1.02% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-38815MEDIUM | VMware NSX contains a content spoofing vulnerability. An unauthenticated malicious actor may be able to craft a URL and redirect a victim to an attacker controlled domain leading to sensitive information disclosure. CWE-79Oct 9, 2024 | CVSS4.3v3.1 | EPSS0.303% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-38818MEDIUM | VMware NSX contains a local privilege escalation vulnerability. An authenticated malicious actor may exploit this vulnerability to obtain permissions from a separate group role than previously assigned. CWE-269Oct 9, 2024 | CVSS6.7v3.1 | EPSS0.272% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-38817MEDIUM | VMware NSX contains a command injection vulnerability. A malicious actor with access to the NSX Edge CLI terminal may be able to craft malicious payloads to execute arbitrary commands on the operating system as root. CWE-77Oct 9, 2024 | CVSS6.7v3.1 | EPSS0.521% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |