Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-22719

VMware Aria Operations command injection vulnerability

Affects VMware Aria Operations 8.18.x through 8.18.5 and 9.0 through 9.0.1 while support-assisted product migration is in progress. Fixed in 8.18.6.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
Fix
Fixed in 8.18.6, 9.0.2, 5.2.3
None on Exploit-DB, Metasploit or GitHub

Summary

VMware Aria Operations is affected, and an unauthenticated attacker could exploit a command injection flaw during support-assisted product migration to run arbitrary commands, potentially gaining remote code execution on the system.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.  To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001  Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated
  5. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • VMware Aria Operations

    From 8.18.x · fixed in 8.18.6

  • VMware Cloud Foundation Operations

    From 9.0 · fixed in 9.0.2; From 4.0 · fixed in 5.2.3

  • vmware-telco-cloud-platform

    From 2.0 · fixed in 5.2.3

  • vmware-telco-cloud-infrastructure

    From 2.0 · fixed in 5.2.3

References 3

support.broadcom.com

knowledge.broadcom.com

techdocs.broadcom.com

FAQ

Questions about CVE-2026-22719

What does this mean?

A command injection flaw in VMware Aria Operations lets an attacker execute arbitrary commands, which may lead to remote code execution. The advisory describes the impact but does not give further technical detail.Source: support.broadcom.com, knowledge.broadcom.com

Am I affected, and how do I check?

Aria Operations version 8 up to and including 8.18.5 and version 9 up to and including 9.0.1 are listed, and only while support-assisted product migration is in progress. VMware Cloud Foundation Operations, Telco Cloud Platform and Telco Cloud Infrastructure are also listed in the affected product ranges, so compare the installed version of each product against those ranges.Source: support.broadcom.com, knowledge.broadcom.com

What should I do about it?

Apply the patches in the 'Fixed Version' column of the VMware Response Matrix. The listed fixed versions are Aria Operations 8.18.6, Cloud Foundation Operations 9.0.2 and 5.2.3, and Telco Cloud Platform and Telco Cloud Infrastructure 5.2.3.Source: support.broadcom.com, knowledge.broadcom.com

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-03-03, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data