CVE-2026-22721

—

CVSS 3.1

7.2 high

EPSS

<1%p51

Published

Feb 25, 2026 (Feb 25, 2026)

Modified

Jun 17, 2026

Description

VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found in VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 .

Vendors: vmware
Products: aria operations, cloud foundation, telco cloud infrastructure, telco cloud platform
Weakness: CWE-269
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news3 stories

CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026

The Hacker NewsMar 4, 04:35 UTC · Mar 4, 2026Advisory in the wildCVE-2026-22719 CVE-2026-22721

⚡ Weekly Recap: SD-WAN 0-Day, Critical CVEs, Telegram Probe, Smart TV Proxy SDK and More

The Hacker NewsMar 2, 13:26 UTC · Mar 2, 2026Data breach in the wildCVE-2026-20127 CVE-2025-40538 CVE-2025-40539+27 CVEs

VMware Aria Operations flaws could enable remote attacks

Security AffairsFeb 24, 15:03 UTC · Feb 24, 2026Exploit / PoC CVE-2026-22719 CVE-2026-22720 CVE-2026-22721