Database/Kernel, userspace & hypervisor
VMware NSX: unauthenticated username enumeration through the password-recovery and login paths
Impact
An unauthenticated attacker who can reach the NSX manager interface can confirm which usernames are valid, turning a blind credential-stuffing attempt into a targeted brute force against the network-virtualization control plane. NSX defines the segments, firewall rules and overlay that separate tenants on a virtualized fleet, so an account that is eventually guessed is an account that can re-wire tenant isolation. The flaw itself discloses only account names - no access is granted by it. Broadcom split this across two ids (CVE-2025-41251, CVE-2025-41252) covering the weak password-recovery mechanism and the login-path enumeration; both carry the same advisory, the same fixed builds and the same operator action.
Who can reach it
Anyone with network reach to the NSX manager web interface, including anyone on the management VLAN. No authentication required.
What to do
Upgrade to NSX 9.0.1.0, 4.2.2.2/4.2.3.1 or 4.1.2.7, NSX-T 3.2.4.3, or apply the VMware Cloud Foundation async patch per KB88287. Broadcom lists no workaround, so patching is the only fix; the work is an NSX manager appliance upgrade in a maintenance window rather than anything that touches GPU hosts. Until then, keep the NSX manager off any routable network and in front of an SSO or VPN gate so the endpoints are not reachable unauthenticated.
Also covers 1 CVE
The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.
References
Related entries
- libssh: unchecked OpenSSL error can leave a partially initialized ChaCha20 context in useCVE-2025-5987 · libssh (ChaCha20 cipher context initialization via OpenSSL)High
- Linux kernel ibmvfc: a malicious VIO server leaks kernel memory through an unclamped target countCVE-2026-31464 · Linux kernel ibmvfc (IBM Power virtual FC discover-targets response)High
- OpenSSH scp: file fetched as root with -O and without -p can land setuid or setgidCVE-2026-35385 · OpenSSH scp (legacy SCP protocol mode, -O without -p)High
- Linux kernel x86/ftrace: dynamic trampoline mis-relocates per-cpu call-depth accounting, crashing the hostCVE-2026-64235 · Linux kernel x86 ftrace dynamic trampolines (CALL_DEPTH_ACCOUNT %rip-relative relocation)High
- Linux SLUB: krealloc __GFP_ZERO guarantee broken when red zoning is enabled without user trackingCVE-2026-64368 · Linux kernel SLUB allocator (init-on-alloc zeroing under SLAB_RED_ZONE)High
- Linux SUNRPC: unchecked percpu_counter_init leaves nfsd running on NULL per-cpu statsCVE-2026-89547 · Linux kernel SUNRPC (__svc_create per-pool percpu_counter init)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.