CVE-2026-22719highunder attackCWE-77

CVE-2026-22719: high-severity vulnerability in VMware Aria Operations

VMware Aria Operations command injection vulnerability

Published · Updated

Follow this CVE+ Monitor Telco Cloud Platform+ Monitor VMware Aria Operations

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.1epss 18%
from disclosure to weapon
Published on NVDFeb 25
CISA KEV+6d
Action required by CISAfederal deadline: 2026-03-24

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

VMware Aria Operations has a vulnerability that allows attackers to run unauthorized commands on the system without needing to log in, potentially taking complete control of the software during data migration processes.

Technical detail

This command injection vulnerability (CWE-77) exists in VMware Aria Operations and can be exploited by an unauthenticated attacker during support-assisted product migration to execute arbitrary commands, leading to remote code execution. The attack vector is network-based and requires the migration feature to be actively in progress.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.  To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001  Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
VMware · Telco Cloud InfrastructureVMware · Telco Cloud PlatformVMware · VMware Aria OperationsVMware · VMware Cloud Foundation Operations
Related CVEs — VMware Aria Operations

In the same product, most dangerous first.

CVE-2026-59310CRITICALvCenter directory-traversal vulnerabilityEPSS 61.7%KEVCVE-2025-41244HIGHVMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)EPSS 16.4%KEVCVE-2025-22224CRITICALCVE-2025-22224EPSS 1.6%KEVCVE-2026-41709LOWESX insufficient logging vulnerabilityEPSS 0.7%KEVCVE-2025-41239HIGHvSockets information-disclosure vulnerabilityEPSS 3.2%CVE-2025-41236CRITICALVMXNET3 integer-overflow vulnerabilityEPSS 2.6%