CVE-2026-22719

VMware Aria Operations command injection vulnerability

At a glance

Severity: HIGH 8.1
Exploitation: Known exploited (CISA KEV) · added 2026-03-03
Exploited per ENISA since 2026-03-03
EPSS: EPSS 18.32 % · percentile 97 (2026-10-28)
State: PUBLISHED
Published: 2026-02-25
Updated: 2026-04-14
Assigner: vmware
NVD status: Analyzed

Description

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	vmware
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · security@vmware.com (Secondary)

Weaknesses (CWE)

CWE-77

European references

ENISA EUVD · EUVD-2026-8708
GCVE · GCVE-0-2026-22719

CERT-FR advisories

CERTFR-2026-AVI-0199 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:* ≥ 8.0 < 8.18.6
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* ≥ 4.0 < 5.2.3
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* ≥ 9.0 < 9.0.2.0
cpe:2.3:a:vmware:telco_cloud_infrastructure:*:*:*:*:*:*:*:* ≥ 2.2 ≤ 3.0
cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:* ≥ 4.0 ≤ 5.1

Affected products

Product	Versions
VMware · VMware Aria Operations	affected 8.18.x < 8.18.6
VMware · VMware Cloud Foundation Operations	affected 9.0 < 9.0.2 ; unaffected 9.0.2 ; affected 4.0 < 5.2.3 ; unaffected 5.2.3
VMware · Telco Cloud Platform	affected 2.0 < 5.2.3 ; unaffected 5.2.3
VMware · Telco Cloud Infrastructure	affected 2.0 < 5.2.3 ; unaffected 5.2.3

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
CISA Known Exploited Vulnerabilities	CC0 1.0
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD