CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-22719 | Unauthenticated Command Injection RCE in Broadcom VMware Aria Operations Broadcom's VMware Aria Operations (formerly vRealize Operations) contains a command injection flaw (CWE-77, CVSS 3.1 base score 8.1) that allows a malicious unauthenticated remote actor to execute arbitrary operating-system commands. The vulnerability is only exploitable while a support-assisted product migration is in progress, which narrows the attack window but requires no privileges or user interaction. Successful exploitation yields remote code execution on the affected Aria Operations instance. Organizations running Aria Operations standalone or as part of VMware Cloud Foundation, VMware Telco Cloud Infrastructure, or VMware Telco Cloud Platform are affected. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-03, and its EPSS score of 17.4% (97th percentile) indicates elevated near-term exploitation risk. Do: Apply the patches listed in the Fixed Version column of the Response Matrix in VMSA-2026-0001 (https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947). If patching must be delayed, implement the workarounds documented in the Workarounds column of the same Response Matrix and defer any support-assisted product migrations until systems are patched. Federal agencies must follow BOD 22-01 guidance given the KEV listing; all defenders should check whether support-assisted migrations are in progress or scheduled on their Aria Operations instances. | 8.1 | 17% | KEV |
| large≈10,000–100,000 enterprise deployments of Aria Operations worldwide, with only instances running a support-assisted migration exploitable at any given time | |
| CVE-2026-22721 | VMware Aria Operations contains a privilege escalation vulnerability. VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found in VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 . NVD description · AI analysis pending | 7.2 | <1% |
| — |
Full article281 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 04, 2026Vulnerability / Enterprise Security
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a recently disclosed security flaw impacting Broadcom VMware Aria Operations to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild.
The high-severity vulnerability, CVE-2026-22719 (CVSS score: 8.1), has been described as a case of command injection that could allow an unauthenticated attacker to execute arbitrary commands.
"A malicious unauthenticated actor may exploit this issue to execute arbitrary commands, which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress," the company said in an advisory released late last month.
The shortcoming was addressed, along withCVE-2026-22720, a stored cross-site scripting vulnerability, and CVE-2026-22721, a privilege escalation vulnerability that could result in administrative access. It impacts the following products -
- VMware Cloud Foundation and VMware vSphere Foundation 9.x.x.x - Fixed in 9.0.2.0
- VMware Aria Operations 8.x - Fixed in 8.18.6
Customers who cannot apply the patch immediately can download and run a shell script ("aria-ops-rce-workaround.sh") as root from each Aria Operations Virtual Appliance node.
There are currently no details on how the vulnerability is being exploited in the wild, who is behind it, and the scale of such efforts.
"Broadcom is aware of reports of potential exploitation of CVE-2026-22719 in the wild, but we cannot independently confirm their validity," the company noted in an update to its bulletin.
In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are required to apply the fixes by March 24, 2026.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/03/cisa-adds-actively-exploited-vmware.html