HackZoneLabs News
Newsletter

CVE-2026-22719

VMware Aria Operations command injection vulnerability

  • High 8.1
  • Exploited: added to CISA KEV 3 Mar 2026

Description

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.  To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001  Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001

Key facts

Published
25 Feb 2026
Last changed
14 Apr 2026
Assigned by
vmware
KEV added
3 Mar 2026
KEV fix due
24 Mar 2026
EPSS
18.321% likely to be exploited in the next 30 days, higher than 97.271% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: active; Automatable: no; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 8.1CVSS 3.1, Highfrom the CNA (vmware)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What to do

  • Apply the vendor patches listed in the 'Fixed Version' column of the Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947  in VMSA-2026-0001. Fixed versions include VMware Aria Operations 8.18.6 (for 8.x) and VMware Cloud Foundation Operations 9.0.2.0 (for 9.x).CNA solution statement
  • Workarounds are available and documented by the vendor (see  VMSA-2026-0001  KB430349) https://knowledge.broadcom.com/external/article/430349 for environments where immediate patching is not possible.CNA workaround statement
  • Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
VMwareVMware Aria Operations
  • Default status: affected
  • 8.18.x up to but excluding 8.18.6 (affected)
VMwareVMware Cloud Foundation Operations
  • Default status: affected
  • 9.0 up to but excluding 9.0.2 (affected)
  • 9.0.2 (unaffected)
  • 4.0 up to but excluding 5.2.3 (affected)
  • 5.2.3 (unaffected)
VMwareTelco Cloud Platform
  • Default status: affected
  • 2.0 up to but excluding 5.2.3 (affected)
  • 5.2.3 (unaffected)
VMwareTelco Cloud Infrastructure
  • Default status: affected
  • 2.0 up to but excluding 5.2.3 (affected)
  • 5.2.3 (unaffected)

Timeline

  1. 25 Feb 2026 Published
  2. 3 Mar 2026 CVE-2026-22719 added to CISA KEV
  3. 3 Mar 2026 Added to the CISA KEV catalogue

Weakness

References