high8.1Known exploited
CVE-2026-22719
Broadcom VMware Aria Operations Command Injection Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-03-03. Federal due date: 2026-03-24.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Aria Operations | from 8.0 before 8.18.6 |
| Vmware | Cloud Foundation | from 4.0 before 5.2.3 from 9.0 before 9.0.2.0 |
| Vmware | Telco Cloud Infrastructure | from 2.2 through 3.0 |
| Vmware | Telco Cloud Platform | from 4.0 through 5.1 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://knowledge.broadcom.com/external/article/430349
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947
- https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22719