VMware plugs steal-my-credentials holes in Cloud Foundation

Broadcom has fixed five flaws, collectively deemed "high severity," in VMware's IT operations and log management tools within Cloud Foundation, including two information disclosure bugs that could lead to credential leakage under certain conditions. All five have patches available. Broadcom's security advisory doesn't note any in-the-wild exploits, yet. We note that exploitation requires authorized access to vulnerable deployments, so if these are successfully abused in the wild, it'll most likely be through compromised or rogue accounts. The CVEs affect Aria Operations, used for managing IT operations across different environments, and Aria Operations for Logs, which is a tool for storing and analyzing log data. Both are pieces of VMware Cloud Foundation, meaning the bugs also affect versions 4.x and 5.x of the hybrid cloud platform. Specifically: Four of the vulnerabilities (CVE-2025-22218, CVE-2025-22219, CVE-2025-22220, and CVE-2025-22221) affect VMware Aria Operations for Logs versions 8 and newer, and one (CVE-2025-22222) affects the same versions of VMware Aria Operations. Updating both products to v8.18.3 will fix the issue. VMware Cloud Foundation users can follow KB92148 to apply the necessary fixes. The most severe of the bunch is CVE-2025-22218, an 8.5-rated information disclosure vulnerability in VMware Aria Operations for Logs. "A malicious actor with View Only Admin permissions may be able to read the credentials of a VMware product integrated with VMware Aria ...