{"id":"vmware-aria-command-injection-mar-2026","category":"patch","status":"live","title":"VMware Aria Operations command injection CVE-2026-22719 used in attacks","tldr":"CISA lists VMware Aria Operations flaw CVE-2026-22719 as exploited. It permits commands without a login during support-assisted migration. Ask IT to install the fixed release; older Telco installations need Broadcom's upgrade guidance.","summary":"CVE-2026-22719 affects VMware Aria Operations, business software that monitors servers and cloud infrastructure, including installations bundled with Cloud Foundation and Telco products. An attacker who has not logged in can run commands during support-assisted product migration, potentially taking control of the affected system. Broadcom disclosed fixes on 24 February. CISA listed the flaw as exploited on 3 March, although Broadcom says it cannot independently confirm the reports. Fixed releases include Aria Operations 8.18.6 and Cloud Foundation Operations 9.0.2.0; Broadcom also identifies Cloud Foundation 5.2.3 as resolved. Telco guidance maps several versions to Aria Operations 8.18.6, but gives no explicit patch path for listed older TCP 2.5 and 2.7 installations. Those customers are directed to support.","action":"Nothing to update on ordinary family phones or computers: this affects business infrastructure. If your business or family office uses it, ask IT to install Aria Operations 8.18.6 or Cloud Foundation Operations 9.0.2.0, following Broadcom's guidance for bundled products; older Telco installations need support advice. If updating must wait, IT can apply Broadcom's temporary workaround to every Aria Operations node.","product":"VMware Aria Operations and its Cloud Foundation and Telco bundles","audience":"work","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2026-22719"],"tags":["broadcom","vmware","aria-operations","command-injection","actively-exploited"],"affected":["VMware Aria Operations 8.x before 8.18.6","VMware Cloud Foundation Operations 9.x before 9.0.2.0, including VMware vSphere Foundation deployments","VMware Cloud Foundation 4.x and 5.x containing vulnerable VMware Aria Operations","VMware Telco Cloud Platform 2.5, 2.7, 3.0, 4.0, 5.0 and 5.0.1 containing VMware Aria Operations, as listed in KB428241","VMware Telco Cloud Infrastructure 2.2, 2.5, 2.7 and 3.0 containing VMware Aria Operations, as listed in KB428241"],"fixed":["VMware Aria Operations 8.18.6","VMware Cloud Foundation Operations 9.0.2.0","VMware Cloud Foundation 5.2.3","VMware Cloud Foundation 9.0.2","Telco bundles: VMware Aria Operations 8.18.6, build 25211474, for the upgrade paths listed in KB428241; unlisted TCP/TCI versions require Broadcom support guidance"],"matches":[],"sources":[{"kind":"advisory","title":"VMSA-2026-0001.1: VMware Aria Operations updates address multiple vulnerabilities","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947","by":"Broadcom","date":"2026-03-03"},{"kind":"advisory","title":"Workaround instructions to address CVE-2026-22719 in Aria Operations 8.18.x and 9.0.x","url":"https://knowledge.broadcom.com/external/article/430349","by":"Broadcom","date":""},{"kind":"advisory","title":"VMware Telco Cloud response to VMSA-2026-0001","url":"https://knowledge.broadcom.com/external/article/428241","by":"Broadcom","date":""},{"kind":"news","title":"CISA flags VMware Aria Operations RCE flaw as exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/cisa-flags-vmware-aria-operations-rce-flaw-as-exploited-in-attacks/","by":"BleepingComputer","date":"2026-03-03"},{"kind":"news","title":"CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 to KEV Catalog","url":"https://thehackernews.com/2026/03/cisa-adds-actively-exploited-vmware.html","by":"The Hacker News","date":"2026-03-04"}],"started":"2026-03-03","closed":null,"created":"2026-11-03T22:29:48.379Z","updated":"2026-11-03T22:29:48.379Z","cve_notes":[{"cve":"CVE-2026-22719","name":"Command injection in VMware Aria Operations migration","what":"A command-injection flaw in VMware Aria Operations lets an attacker without a login run commands, potentially executing their own code, while support-assisted product migration is in progress.","severity":"high","cvss":8.1}],"timeline":[{"at":"2026-11-03","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"At this review, Broadcom's Telco guidance lists Aria Operations 8.18.6 upgrade paths for TCI 2.x/3.x and TCP 3.x/4.x/5.x. It directs unlisted versions to support; its affected-environment list also includes TCP 2.5 and 2.7.","url":"https://knowledge.broadcom.com/external/article/428241","by":"Broadcom","patch":"partial"},{"at":"2026-03-04","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Reporting identified no public details about the attackers, victims or scale of exploitation.","url":"https://thehackernews.com/2026/03/cisa-adds-actively-exploited-vmware.html","by":"The Hacker News","patch":null},{"at":"2026-03-03","added":"2026-11-03T22:24:44.025Z","kind":"vendor-revised","text":"Broadcom updated its advisory to acknowledge reports of exploitation, while saying it could not independently confirm them.","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947","by":"Broadcom","patch":null},{"at":"2026-03-03","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2026-22719 to its Known Exploited Vulnerabilities catalogue and required US federal civilian agencies to address it by 24 March.","url":"https://www.bleepingcomputer.com/news/security/cisa-flags-vmware-aria-operations-rce-flaw-as-exploited-in-attacks/","by":"BleepingComputer","patch":null},{"at":"2026-02-24","added":"2026-11-03T22:24:44.025Z","kind":"disclosed","text":"Broadcom disclosed CVE-2026-22719 and published fixes. The flaw allows commands to run without a login while support-assisted product migration is under way.","url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947","by":"Broadcom","patch":"partial"}],"url":"https://hard.fyi/live/vmware-aria-command-injection-mar-2026/","json":"https://hard.fyi/api/live?id=vmware-aria-command-injection-mar-2026"}