Broadcom · VMware Aria Operations
CVE-2026-22719
VMware Aria Operations command injection vulnerability
What it is
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.
To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001
Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001
CISA: Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: March 24, 2026
More exploited flaws from Broadcom
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 18, 2026 | Path Traversal | VMware vCenter | Critical 9.8 | 2.6% |
| Jan 23, 2026 | Out-of-bounds Write | VMware vCenter Server | Critical 9.8 | 22% |
| Oct 30, 2025 | Privilege Defined with Unsafe Actions | VMware Aria Operations and VMware Tools | High 7.8 | 8.6% |
| Apr 28, 2025 | Code Injection | Brocade Fabric OS | High 8.6 | 0.7% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.