Actively Exploited VMware Aria Operations Vulnerability (CVE-2026-22719)

Key Takeaways

CVE-2026-22719 is a high-severity command injection vulnerability in VMware Aria Operations.
The flaw allows unauthenticated attackers to execute commands remotely during migration processes.
CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation.
VMware released patches in Aria Operations 8.18.6 and 9.0.2.
A temporary workaround script is available but does not address related vulnerabilities.

Organizations running VMware Aria Operations should prioritize patching as soon as possible, as attackers are already exploiting this vulnerability in the wild.

For a deeper technical analysis, see the BaseFortify CVE report for CVE-2026-22719:
https://basefortify.eu/cve_reports/2026/02/cve-2026-22719.html

That report also includes a security Q&A and an AI assistant readers can use to ask questions about the vulnerability, risks, and mitigation steps.

Vulnerability Overview

CVE-2026-22719 is a command injection vulnerability affecting VMware Aria Operations. The flaw can allow an unauthenticated attacker to execute arbitrary commands during a support-assisted product migration process.

Because Aria Operations acts as a central monitoring and automation platform for VMware infrastructure, compromising it could allow attackers to gain deep insight into the environment or move laterally across systems.

The vulnerability has a CVSS score of 8.1 (High).

Affected Products

Product	Fixed Version
VMware Aria Operations 8.x	8.18.6
VMware Cloud Foundation 9.x	9.0.2
VMware vSphere Foundation 9.x	9.0.2

Broadcom released security updates on February 24, 2026.

The same advisory also fixes two additional vulnerabilities:

CVE-2026-22720 – stored cross-site scripting (XSS)
CVE-2026-22721 – privilege escalation

These issues require upgrading to a patched version.

Temporary Workaround

Organizations that cannot immediately apply updates can deploy a temporary mitigation.

Broadcom provides a script that must be executed as root on each Aria Operations node. The script removes migration components and a privileged sudo configuration that could allow command execution.

The workaround script can be reviewed here:

aria-ops-rce-workaround.sh

Example execution:

scp aria-ops-rce-workaround.sh root@OPS_NODE:/root/
ssh root@OPS_NODE
cd /root
chmod +x aria-ops-rce-workaround.sh
./aria-ops-rce-workaround.sh

This workaround only mitigates CVE-2026-22719 and does not address CVE-2026-22720 or CVE-2026-22721.

Active Exploitation

CISA confirmed that attackers are actively exploiting this vulnerability, although details about the attacks or threat actors have not yet been disclosed.

VMware Aria Operations has previously been targeted in attacks exploiting other vulnerabilities, highlighting the importance of timely patching.

Because infrastructure monitoring systems often have privileged access to multiple environments, compromising them can give attackers significant visibility and control.

Recommended Actions

Upgrade immediately to a patched version (8.18.6 or 9.0.2).
Apply the workaround if patching is temporarily not possible.
Restrict external access to management interfaces.
Monitor logs for suspicious command execution or unusual administrative activity.

How BaseFortify Helps

BaseFortify helps organizations identify and respond to vulnerabilities like CVE-2026-22719 by linking installed software components directly to known security issues.

By mapping software inventory to vulnerability intelligence, BaseFortify can show which systems may be exposed, provide clear attack scenarios, and recommend practical mitigation steps before attackers exploit the issue.

Readers can also consult the CVE report, security Q&A, and AI assistant on BaseFortify to better understand the risks and remediation options.