CVE-2026-22719
VMware Aria Operations command injection vulnerability
Broadcom VMware Aria Operations Command Injection Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA notes
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ; https://knowledge.broadcom.com/external/article/430349 ; https://nvd.nist.gov/vuln/detail/CVE-2026-22719
Description
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HAffected Products
| Vendor | Product | Affected versions |
|---|---|---|
| VMware | VMware Aria Operations | 8.18.x to <8.18.6 |
| VMware | VMware Cloud Foundation Operations | 9.0 to <9.0.2 9.0.2 (unaffected) 4.0 to <5.2.3 5.2.3 (unaffected) |
| VMware | Telco Cloud Platform | 2.0 to <5.2.3 5.2.3 (unaffected) |
| VMware | Telco Cloud Infrastructure | 2.0 to <5.2.3 5.2.3 (unaffected) |
References
3 LinksRecord Details
More from VMware
VMware vCenter Server Improper Input Validation Vulnerability
VMware vCenter Server File Upload Vulnerability
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.