VMware NSX XSS Vulnerability Allows Attackers to Inject Malicious Code

Multiple Cross-Site Scripting (XSS) vulnerabilities in the VMware NSX network virtualization platform could allow malicious actors to inject and execute harmful code. 

The security bulletin published on June 4, 2025, details three distinct vulnerabilities affecting VMware NSX Manager UI, gateway firewall, and router port components, with CVSS base scores ranging from 5.9 to 7.5.

CVE-2025-22243: Stored XSS Vulnerability in NSX Manager UI

The CVE-2025-22243 vulnerability represents a critical stored Cross-Site Scripting (XSS) flaw in VMware NSX Manager’s user interface (UI), scoring a CVSSv3 base score of 7.5 (Important severity). 

The issue stems from improper input validation in network configuration fields, allowing persistent injection of malicious JavaScript payloads. 

This vulnerability impacts all VMware NSX versions 4.0.x through 4.2.x, as well as dependent platforms like VMware Cloud Foundation and Telco Cloud Infrastructure.

An attacker with administrative privileges to modify network settings could embed malicious scripts in fields such as DNS names or IP address descriptions. 

These payloads execute automatically when legitimate administrators view the compromised configurations through the NSX Manager UI. 

The attack leverages the privilege escalation risk inherent in management interfaces, as the injected code operates within the victim’s session context, potentially enabling credential theft or lateral movement.

CVE-2025-22244: Stored XSS in Gateway Firewall Response Pages

CVE-2025-22244 affects NSX’s gateway firewall URL filtering component, carrying a CVSSv3 score of 6.9 (Moderate severity). 

The vulnerability allows malicious actors to inject scripts into custom response pages shown when users attempt to access blocked websites. This impacts NSX 4.0.x–4.2.x and dependent cloud platforms.

Attackers with gateway firewall configuration privileges can modify HTML templates for block pages to include