Description
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. 

To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 

Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001
Published: 2026-02-25
Score: 8.1 High
EPSS: 2.1% Low
KEV: Yes
Impact: Remote code execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a command injection flaw that does not properly validate user input, allowing a malicious actor to inject operating‑system commands. An unauthenticated attacker can trigger this during a support‑assisted migration and execute arbitrary commands with the privilege level of the Aria Operations service, potentially compromising the entire platform. The weakness is classified as CWE‑77.

Affected Systems

The flaw affects VMware Aria Operations, VMware Cloud Foundation Operations, VMware Telco Cloud Infrastructure, and VMware Telco Cloud Platform. Versions impacted include Aria Operations 8.x (fixed in 8.18.6) and Cloud Foundation Operations 9.x (fixed in 9.0.2.0).

Risk and Exploitability

The CVSS score of 8.1 marks the vulnerability as high severity. An EPSS score of 2% indicates a modest likelihood of exploitation, and the vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, confirming it has already been targeted. Attackers can exploit the flaw without authentication during migration, giving them full control over the affected systems. The combination of high impact, moderate exploitation probability, and confirmed field exploitation makes this an urgent risk.

Generated by OpenCVE AI on April 15, 2026 at 15:12 UTC.

Remediation

Vendor Solution

Apply the vendor patches listed in the 'Fixed Version' column of the Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947  in VMSA-2026-0001. Fixed versions include VMware Aria Operations 8.18.6 (for 8.x) and VMware Cloud Foundation Operations 9.0.2.0 (for 9.x).

Vendor Workaround

Workarounds are available and documented by the vendor (see  VMSA-2026-0001  KB430349) https://knowledge.broadcom.com/external/article/430349 for environments where immediate patching is not possible.

OpenCVE Recommended Actions

  • Apply the vendor patches for VMware Aria Operations 8.18.6 (for version 8.x) and VMware Cloud Foundation Operations 9.0.2.0 (for version 9.x) as detailed in the VMSA-2026-0001 response matrix.
  • If immediate patching is not possible, deploy the vendor‑documented workarounds available in KB430349 and the workarounds column of VMSA-2026-0001 to mitigate command injection risk during migration.
  • Restrict administrative and migration interfaces to trusted networks or use a staged migration process with strict access controls to reduce the attack window, addressing the command‑injection weakness (CWE‑77).

Generated by OpenCVE AI on April 15, 2026 at 15:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:telco_cloud_infrastructure:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*

Tue, 03 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 03 Mar 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-03-03T00:00:00+00:00', 'dueDate': '2026-03-24T00:00:00+00:00'}

Fri, 27 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 26 Feb 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-77

Thu, 26 Feb 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Vmware
Vmware aria Operations
Vmware cloud Foundation
Vmware telco Cloud Infrastructure
Vmware telco Cloud Platform
Vendors & Products Vmware
Vmware aria Operations
Vmware cloud Foundation
Vmware telco Cloud Infrastructure
Vmware telco Cloud Platform

Wed, 25 Feb 2026 19:45:00 +0000

Type Values Removed Values Added
Description VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.  To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001  Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001
Title VMware Aria Operations command injection vulnerability
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Vmware Aria Operations Cloud Foundation Telco Cloud Infrastructure Telco Cloud Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: vmware

Published:

Updated: 2026-04-14T10:38:25.169Z

Reserved: 2026-01-09T06:54:36.841Z

Link: CVE-2026-22719

cve-icon Vulnrichment

Updated: 2026-02-26T15:50:15.344Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-25T20:23:46.840

Modified: 2026-03-04T15:08:13.743

Link: CVE-2026-22719

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T17:00:07Z

Weaknesses