CVE-2026-22719
Broadcom VMware Aria Operations Command Injection Vulnerability
Description
CVE-2026-22719 is a high-severity command injection vulnerability in Broadcom VMware Aria Operations, a widely deployed IT operations management and monitoring platform. The vulnerability allows an unauthenticated remote attacker to execute arbitrary commands on the underlying server during a specific operational window -- when support-assisted product migration is in progress. With a CVSS v3.1 base score of 8.1 (HIGH), successful exploitation can lead to full remote code execution, compromising the confidentiality, integrity, and availability of the affected system.
CISA has added CVE-2026-22719 to the Known Exploited Vulnerabilities catalog on March 3, 2026, with a remediation deadline of March 24, 2026. The EPSS score of 0.47% at the 64.3rd percentile indicates moderate exploitation probability relative to all tracked vulnerabilities. There is currently no known ransomware association with this vulnerability, though the ability to achieve unauthenticated remote code execution makes it a high-value target for threat actors.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | aria operations | >= 8.0, < 8.18.6 |
| vmware | cloud foundation | >= 4.0, < 5.2.3; >= 9.0, < 9.0.2.0 |
| vmware | telco cloud infrastructure | >= 2.2, <= 3.0 |
| vmware | telco cloud platform | >= 4.0, <= 5.1 |
References
- https://knowledge.broadcom.com/external/article/430349(Mitigation, Vendor Advisory)
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947(Patch, Vendor Advisory)
- https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html(Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22719(US Government Resource)
Weakness Type
CWE-77: Command Injection
CVE-2026-22719 is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command), commonly referred to as command injection. This weakness occurs when an application constructs a command string using externally supplied input without properly neutralizing special elements that can modify the intended command structure.
Unlike OS command injection (CWE-78), which specifically targets operating system shell commands, CWE-77 encompasses a broader class of injection attacks against any command interpreter or execution environment. In the context of VMware Aria Operations, the vulnerability exists in a component that processes input during support-assisted migration operations. Because this input is not properly sanitized before being incorporated into executable commands, an attacker can inject malicious command elements that are interpreted and executed by the target system. The fact that this vulnerability is exploitable without authentication makes it particularly dangerous, as it eliminates the need for credential theft or privilege escalation as a prerequisite for exploitation.
Impact Analysis
The impact of CVE-2026-22719 is significant across all three dimensions of the CIA triad, though the high attack complexity introduces a mitigating factor.
Confidentiality faces high impact because successful command injection grants the attacker the ability to read sensitive data on the VMware Aria Operations server. This includes monitoring configurations, credentials for managed infrastructure, API keys, certificates, and operational data collected from monitored systems across the enterprise. Given that Aria Operations serves as a centralized management platform, the breadth of accessible information can be extensive.
Integrity is rated high because an attacker with command execution capabilities can modify system configurations, alter monitoring rules and thresholds, inject false data into operational dashboards, install persistent backdoors, and potentially pivot to other systems managed by the platform. Manipulation of a monitoring platform is especially insidious because it can blind an organization to other ongoing attacks.
Availability is at high risk since the attacker can disrupt or disable the Aria Operations platform entirely, affecting the organization's ability to monitor and manage its IT infrastructure. Degradation of the monitoring platform can have cascading effects on incident detection and response capabilities.
The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U) reveals that while the attack is network-accessible and requires no privileges or user interaction, the attack complexity is high -- exploitation depends on the specific condition of a support-assisted migration being in progress. This temporal constraint reduces the practical attack window but does not diminish the severity of successful exploitation.
Exploit Maturity
CVE-2026-22719 has been confirmed as actively exploited, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog on March 3, 2026, with a federal remediation deadline of March 24, 2026. This confirms that threat actors have successfully weaponized this vulnerability in real-world attacks.
The EPSS score of 0.47% at the 64.3rd percentile places it in the upper third of all tracked vulnerabilities for exploitation probability. While not among the highest EPSS scores, the KEV listing carries greater weight as it represents confirmed active exploitation rather than a statistical prediction.
Broadcom has published security advisories documenting the vulnerability at support-content-notification/SecurityAdvisories/0/36947 and a detailed knowledge base article at article/430349. The exploitation condition -- that a support-assisted migration must be in progress -- limits the attack window, but organizations actively undergoing migrations are at acute risk. VMware products are high-value targets for advanced threat actors due to their central role in enterprise infrastructure management.
Remediation
-
Apply the vendor patch immediately. Broadcom has released security updates addressing CVE-2026-22719. Review the official Broadcom Security Advisory and the Knowledge Base Article 430349 for specific patch versions and upgrade instructions for your VMware Aria Operations deployment.
-
Suspend non-critical migration activities. If your organization is currently conducting or planning a support-assisted product migration, evaluate whether the migration can be postponed until the patch is applied. The vulnerability is only exploitable during active migration processes, so halting migrations eliminates the attack vector.
-
Restrict network access to Aria Operations. Implement strict network segmentation and firewall rules to limit access to the VMware Aria Operations management interface. Only allow connections from trusted administrator workstations and management networks. Block all unnecessary inbound traffic to the platform.
-
Monitor for indicators of compromise. Review system logs, network traffic, and process execution history on the Aria Operations server for signs of unauthorized command execution. Look for unexpected processes, new files, modified configurations, or unusual outbound network connections that could indicate post-exploitation activity.
-
Rotate credentials and certificates. If the Aria Operations instance was running a vulnerable version during any migration activity, treat it as potentially compromised. Rotate all credentials stored in or accessible through the platform, including service accounts, API tokens, and certificates used for monitoring integrations.
-
Conduct a broader infrastructure review. Since Aria Operations manages and monitors other systems, assess whether any managed infrastructure may have been affected through lateral movement or credential reuse from a compromised Aria Operations instance.
Technical Details
CVE-2026-22719 is a command injection vulnerability in VMware Aria Operations with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, yielding a base score of 8.1 (HIGH).
Breaking down the vector components:
- Attack Vector (AV:N): The vulnerability is exploitable remotely over the network, requiring no physical or local access to the target system.
- Attack Complexity (AC:H): Exploitation requires specific conditions to be met -- the support-assisted product migration process must be actively running. This is a significant constraint that reduces the practical exploitability.
- Privileges Required (PR:N): No authentication or prior access is needed. An unauthenticated attacker can exploit the vulnerability, which substantially increases the threat level.
- User Interaction (UI:N): No action from a legitimate user is required to trigger the vulnerability.
- Scope (S:U): The impact is contained within the vulnerable component (the Aria Operations server itself), though the practical impact extends to managed systems through the platform's administrative capabilities.
- Impact (C:H/I:H/A:H): All three CIA dimensions are rated high, indicating that successful exploitation grants the attacker substantial control over the system.
The vulnerability resides in a component that handles data or commands during the support-assisted migration workflow. When this migration is in progress, certain inputs are processed without adequate sanitization, allowing an attacker to inject command elements that are executed by the system. The unauthenticated nature of the attack vector suggests that the migration endpoint or service is exposed without proper access controls during the migration window.
Frequently Asked Questions
What is CVE-2026-22719?
CVE-2026-22719 is a command injection vulnerability in Broadcom VMware Aria Operations that allows an unauthenticated remote attacker to execute arbitrary commands on the server. Exploitation is possible when a support-assisted product migration is actively in progress.
Is CVE-2026-22719 being actively exploited?
Yes. CISA confirmed active exploitation by adding CVE-2026-22719 to the Known Exploited Vulnerabilities (KEV) catalog on March 3, 2026, with a federal remediation deadline of March 24, 2026.
Does an attacker need credentials to exploit this vulnerability?
No. The vulnerability is exploitable by an unauthenticated attacker, meaning no valid credentials or prior access to the system are required. However, the attack complexity is high because a support-assisted migration must be in progress at the time of the attack.
Is this vulnerability associated with ransomware?
Currently, there is no known ransomware association with CVE-2026-22719. However, the ability to achieve remote code execution without authentication makes it a potentially attractive vector for ransomware operators targeting enterprise infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.