Critical Vulnerability in VMware vSphere Plug-in Allows Session Hijacking

VMware warns administrators to remove the deprecated Enhanced Authentication Plug-in (EAP) after disclosure of two vulnerabilities—CVE-2024-22245 (critical Kerberos relay allowing authentication ticket relaying) and CVE-2024-22250 (session-hijack via weak log-file permissions)—that could let an attacker with local or web-based interaction hijack privileged vSphere sessions; VMware provides removal steps and recommends alternative authentication methods, and there is no evidence of active exploitation.