Vulnerability intelligence
CVE-2026-22719
Broadcom VMware Aria Operations Command Injection Vulnerability
Broadcom VMware Aria Operations
Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.
CVSS Score
—
Unrated
EPSS — Exploit Probability
17%
Riskier than 97% of all CVEs · checked 2026-09-04
Exploitation
Confirmed in the wild
KEV since 2026-03-03
Remediation
Unconfirmed
Federal deadline 2026-03-24
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-24.
8 articles across 6 outlets · first covered Feb 24, 2026 · latest Mar 5, 2026
Coverage timeline
-
CVE-2026-22719 Unauthenticated command injection risks RCE in VMware Aria Operationswww.cisa.gov · Mar 5, 2026
-
CISA adds CVE-2026-22719 to KEV, VMware Aria Operations at riskcisa.gov · Mar 5, 2026
-
VMware Aria Operations hit by CVE-2026-22719 RCE exploitwww.darkreading.com · Mar 4, 2026
-
CISA Adds CVE-2026-22719 and CVE-2026-21385 to the Exploited Listsecurityaffairs.com · Mar 4, 2026
-
VMware Aria Operations CVE-2026-22719 Enables Unauthenticated RCEwww.securityweek.com · Mar 4, 2026
-
CISA flags CVE-2026-22719 in Broadcom VMware Aria Operations RCEthehackernews.com · Mar 4, 2026
-
VMware Aria Operations must be patched after CVE-2026-22719securityaffairs.com · Feb 24, 2026
-
Broadcom patches command injection in VMware Aria CVE-2026-22719www.securityweek.com · Feb 24, 2026