MSRXCVE-2026-22719
CVE-2026-22719
Broadcom VMware Aria Operations Command Injection Vulnerability
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS 3.1 · CNA · vmware.com
chance of exploitation in the next 30 days (EPSS; higher than 97% of CVEs)
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001
Scores
Affected products
- vmware aria operations: ≥ 8.0, < 8.18.6
- vmware cloud foundation: ≥ 4.0, < 5.2.3; ≥ 9.0, < 9.0.2.0
- vmware telco cloud infrastructure: ≥ 2.2, ≤ 3.0
- vmware telco cloud platform: ≥ 4.0, ≤ 5.1
Weakness: CWE-77
4 references (advisories, patches, write-ups)
- https://knowledge.broadcom.com/external/article/430349 · Mitigation, Vendor Advisory
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 · Patch, Vendor Advisory
- https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html · Release Notes
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22719 · US Government Resource
Sources: NVD, CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.