CVE-2025-22219 is a medium severity (CVSS 6.8) stored cross-site scripting flaw in VMware Aria Operations for Logs, also listed against VMware Cloud Foundation. A user without administrator rights may inject a script that runs operations as an admin. Apply the fix listed in the Broadcom advisory for your version.
What's affected
The NVD record lists two products: VMware Aria Operations for Logs and VMware Cloud Foundation. It does not give version ranges, and the Broadcom advisory page could not be loaded when this guide was reviewed, so the exact affected and fixed builds are not repeated here. Treat the Broadcom advisory (reference 25329 in the sources) as the authority for which releases are fixed.
The CVSS vector is AV:N/AC:L/PR:H/UI:R. In plain terms: the attack runs over the network, needs an account with high privileges, and needs another user to do something, such as opening a page. Those conditions are why the score sits at 6.8 even though the possible impact on confidentiality, integrity and availability is rated high.
How to check if you're exposed
Find out whether you run the product and which build:
# In the Aria Operations for Logs UI, open the About page
# and note the version and build number.
If it is part of a VMware Cloud Foundation deployment, check the bill of materials for the Cloud Foundation release you run and compare it with the Broadcom advisory. Also list who holds a non-administrator account that can store content in the product, because that is the group the advisory says may inject the script.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Open the Broadcom advisory for this CVE and find the fixed build for your release train.
- Schedule the upgrade or patch. A medium score with high privileges required is not an emergency, but admin session abuse is a real risk on a log platform.
- Review which non-administrator accounts can create or edit stored content, and remove access that is not needed.
- Ask admins to avoid opening unexpected links or pages in the product until the patch is applied.
- Record the version after the upgrade so your inventory shows the fix.
Why it matters
CWE-79 is cross-site scripting. The product stores content from one user and later shows it to another without neutralizing it, so a script written by a low privilege user runs in an administrator's browser session. The advisory wording is that this may lead to arbitrary operations as the admin user.
Log platforms are attractive for this class of bug because they hold data from many systems and are often reachable by many staff. Stored XSS needs no phishing link beyond a normal page view, which is why it is worth patching even when the headline score is moderate. The record does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities list.
Quick check
Does an attacker need to be an administrator?
No, the description says a malicious actor with non-administrative privileges may inject the script. The result runs with admin rights in the victim's session, and the CVSS vector notes that high privileges and user interaction are involved.
Is it exploited in the wild?
The NVD record's KEV flag is false and the Broadcom page could not be checked for this review, so no exploitation is claimed here.
Sources
Last reviewed: 19 October 2026.
