VMware Aria Operations command injection CVE-2026-22719 used in attacks
CISA lists VMware Aria Operations flaw CVE-2026-22719 as exploited. It permits commands without a login during support-assisted migration. Ask IT to install the fixed release; older Telco installations need Broadcom's upgrade guidance.
Nothing to update on ordinary family phones or computers: this affects business infrastructure. If your business or family office uses it, ask IT to install Aria Operations 8.18.6 or Cloud Foundation Operations 9.0.2.0, following Broadcom's guidance for bundled products; older Telco installations need support advice. If updating must wait, IT can apply Broadcom's temporary workaround to every Aria Operations node.
What’s happening
CVE-2026-22719 affects VMware Aria Operations, business software that monitors servers and cloud infrastructure, including installations bundled with Cloud Foundation and Telco products. An attacker who has not logged in can run commands during support-assisted product migration, potentially taking control of the affected system. Broadcom disclosed fixes on 24 February. CISA listed the flaw as exploited on 3 March, although Broadcom says it cannot independently confirm the reports. Fixed releases include Aria Operations 8.18.6 and Cloud Foundation Operations 9.0.2.0; Broadcom also identifies Cloud Foundation 5.2.3 as resolved. Telco guidance maps several versions to Aria Operations 8.18.6, but gives no explicit patch path for listed older TCP 2.5 and 2.7 installations. Those customers are directed to support.
- What
- Flaw
- Affects
- VMware Aria Operations and its Cloud Foundation and Telco bundles
- Affected
- VMware Aria Operations 8.x before 8.18.6
VMware Cloud Foundation Operations 9.x before 9.0.2.0, including VMware vSphere Foundation deployments
VMware Cloud Foundation 4.x and 5.x containing vulnerable VMware Aria Operations
VMware Telco Cloud Platform 2.5, 2.7, 3.0, 4.0, 5.0 and 5.0.1 containing VMware Aria Operations, as listed in KB428241
VMware Telco Cloud Infrastructure 2.2, 2.5, 2.7 and 3.0 containing VMware Aria Operations, as listed in KB428241 - Fixed in
- VMware Aria Operations 8.18.6
VMware Cloud Foundation Operations 9.0.2.0
VMware Cloud Foundation 5.2.3
VMware Cloud Foundation 9.0.2
Telco bundles: VMware Aria Operations 8.18.6, build 25211474, for the upgrade paths listed in KB428241; unlisted TCP/TCI versions require Broadcom support guidance - Since
- 3 Mar 2026
Timeline
- UpdatePartly fixed
At this review, Broadcom's Telco guidance lists Aria Operations 8.18.6 upgrade paths for TCI 2.x/3.x and TCP 3.x/4.x/5.x. It directs unlisted versions to support; its affected-environment list also includes TCP 2.5 and 2.7.
- Update
Reporting identified no public details about the attackers, victims or scale of exploitation.
- Vendor revised
Broadcom updated its advisory to acknowledge reports of exploitation, while saying it could not independently confirm them.
- CISA added
CISA added CVE-2026-22719 to its Known Exploited Vulnerabilities catalogue and required US federal civilian agencies to address it by 24 March.
- Made publicPartly fixed
Broadcom disclosed CVE-2026-22719 and published fixes. The flaw allows commands to run without a login while support-assisted product migration is under way.
Sources
- VMSA-2026-0001.1: VMware Aria Operations updates address multiple vulnerabilitiesBroadcom · 3 Mar 2026
- Workaround instructions to address CVE-2026-22719 in Aria Operations 8.18.x and 9.0.xBroadcom
- VMware Telco Cloud response to VMSA-2026-0001Broadcom
- CISA flags VMware Aria Operations RCE flaw as exploited in attacksBleepingComputer · 3 Mar 2026
- CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 to KEV CatalogThe Hacker News · 4 Mar 2026