Enterprise technology vendor VMware on Thursday shipped patches for at least five security defects in its Aria Operations and Aria Operations for Logs products, warning that hackers could exploit these issues to gain admin access.
According to a ‘high-risk’ bulletin from VMware, the two most serious issues (CVE-2025-22218 and CVE-2025-22222) are information disclosure bugs that allows a users to elevate access rights.
The company called special attention to CVE-2025-22218 (CVSS severity score 8.5/10) that affects the enterprise-facing Aria Operations for Logs product. VMware said user with ‘View Only Admin’ permissions could access credentials for an integrated VMware product.
The second information disclosure issue, which affects Aria Operations, allows a user with non-administrative privileges to retrieve credentials for an outbound plugin if a valid service credential ID is known.
The company also flagged several moderate-severity issues that allows stored cross-site scripting (XSS) attacks where non-admin users can inject a malicious script that executes as an admin, potentially allowing unauthorized actions.
VMware also patched a broken access control vulnerability in Aria Operations for Logs that can be exploited by a non-admin user with network access to the API to execute operations as an admin.
The company cautioned that there are no pre-patch workarounds for these vulnerabilities, meaning patching is required to mitigate the risks. The company released fixes in Aria Operations for Logs 8.18.3 and Aria Operations 8.18.3.
It’s not uncommon for threat actors to exploit VMware product vulnerabilities in their attacks, including flaws in Aria Operations.
Related: CISA Tells US Agencies to Patch Exploited VMware Flaws
Related: VMware Confirms Live Exploits Hitting Just-Patched Security Flaw
Related: VMware vCenter Flaw So Critical, Patches Released for EOL Products
Related: Exploit Code Published for Critical-Severity VMware Security Defect
