Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2026-22719

HighExploitedPublic exploit

VMware Aria Operations command injection vulnerability

Published Feb 25, 2026 · Updated Apr 14, 2026

Key Facts

Patch immediately
  • CVE-2026-22719 is a high-severity vulnerability (CVSS 8.1 v3.1) affecting Aria Operations (Vmware), Cloud Foundation (Vmware), Telco Cloud Infrastructure (Vmware) and 2 more products.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Mar 3, 2026. Public exploit code is available.
  • EPSS estimates a 18% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Aria Operations 8.18.6, Cloud Foundation 5.2.3, VMware Cloud Foundation Operations 5.2.3.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

8.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

18%

Higher than 97.1% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2026-22719 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.

To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001

Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVMar 3, 2026Mar 24, 2026Not reported
Industry KEV feedMar 3, 2026Mar 24, 2026Not reported
CIRCL KEVMar 3, 2026Mar 24, 2026Not reported
ENISA EUVDMar 3, 2026n/aNot reported

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Products

8 affected entries in total
ProductAffected versionsFixed in
Aria OperationsVmware>= 8.18.x8.18.6
Cloud FoundationVmwareSee advisory5.2.3
Telco Cloud InfrastructureVmware>= 2.03.0
Telco Cloud PlatformVmware>= 2.05.1
VMware Cloud Foundation Operations>= 9.09.0.2

Patched Releases

Aria Operations

8.18.6

Cloud Foundation

5.2.3

VMware Cloud Foundation Operations

5.2.3, 9.0.2

Telco Cloud Infrastructure

3.0, 5.2.3

Telco Cloud Platform

5.1, 5.2.3

Timeline

  1. Publicly disclosed

    Feb 25, 2026

  2. Added to CISA KEV

    Mar 3, 2026

  3. Added to Industry KEV feed

    Mar 3, 2026

  4. Added to CIRCL KEV

    Mar 3, 2026

  5. Added to ENISA EUVD

    Mar 3, 2026

  6. Last updated

    Apr 14, 2026

Weakness Type

  • CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

References

FAQ

Common Questions.

Is CVE-2026-22719 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo