PT-2026-21684 · Vmware · Vmware Aria Operations

Published 2026-02-24 · Updated 2026-04-02 · CVE-2026-22719

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: VMware Aria Operations versions 8.0 through 8.18.5 and 9.0 through 9.0.1.

Description: VMware Aria Operations contains a command injection vulnerability that allows a malicious unauthenticated actor to execute arbitrary commands, potentially leading to remote code execution during support-assisted product migration. This vulnerability is actively exploited in the wild and has been added to CISA's KEV catalog.

Recommendations: Upgrade VMware Aria Operations to version 8.18.6 or later, or VMware Cloud Foundation to version 9.0.2.0 or later. If immediate patching is not possible, apply the workaround script provided by Broadcom.

Fix

RCE

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2026-02323

CVE-2026-22719

Affected Products

Vmware Aria Operations

References · 121

• https://nvd.nist.gov/vuln/detail/CVE-2026-22719 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22719 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02323 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22719 · Note
• https://twitter.com/exc_actual/status/2026583907286778084 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2029019354151391726 · Twitter Post
• https://twitter.com/integ_sec/status/2038626802516558311 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1rkdmyx/cisa_adds_actively_exploited_vmware_aria · Reddit Post
• https://twitter.com/pigram86/status/2029073971103084607 · Twitter Post
• https://twitter.com/ThreatSynop/status/2029135909598199925 · Twitter Post
• https://twitter.com/ctrlaltnod/status/2029349342063042683 · Twitter Post
• https://twitter.com/jackgoesvirtual/status/2029411284349862288 · Twitter Post
• https://twitter.com/TweetThreatNews/status/2029074380928544863 · Twitter Post
• https://twitter.com/evanderburg/status/2029072242450284925 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1rkpkdh/vmware_aria_operations_vulnerability_cve202622719 · Reddit Post