CVE-2026-22719 | VMware Aria Operations command injection vulnerability

Exp

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.  To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001  Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001

Published: 2026-02-25 Last update: 2026-03-04 Assigner: [email protected] Source: [email protected]
NVD Status：Analyzed，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2026-22719 is rated Critical Active Threat (86.5/100): CVSS High severity, with medium exploitation likelihood (EPSS 1.90%). CISA KEV confirms active exploitation (added 2026-03-03) affecting Broadcom / VMware Aria Operations. a weakness (CWE-77) Unauthenticated remote administrative access may be possible. The CISA remediation deadline has passed—treat as an emergency patch priority.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

CISA KEV Record for CVE-2026-22719

Name: Broadcom VMware Aria Operations Command Injection Vulnerability · CISA KEV detail

Exploit added: 2026-03-03

Action due: 2026-03-24

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Exploit prediction scoring system (EPSS) score for CVE-2026-22719

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-02 2.10% 1.90% -0.19%
2 2026-05-31 1.79% 2.10% +0.31%
3 2026-05-28 — 1.79% —

Full EPSS history (15 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-22719

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
8.1 3.1 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 2.2 5.9 [email protected]

Weakness enumeration for CVE-2026-22719

Affected software / configurations for CVE-2026-22719

Vendor Product Version Raw CPE
vmware aria_operations >= 8.0, < 8.18.6 cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:*
vmware cloud_foundation >= 4.0, < 5.2.3 cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
vmware cloud_foundation >= 9.0, < 9.0.2.0 cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
vmware telco_cloud_infrastructure >= 2.2, <= 3.0 cpe:2.3:a:vmware:telco_cloud_infrastructure:*:*:*:*:*:*:*:*
vmware telco_cloud_platform >= 4.0, <= 5.1 cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*

References for CVE-2026-22719

cvelogic Threat Intelligence