Not scored
CVE-2026-22720
VMware Aria Operations stored cross-site scripting vulnerability
VMwareVMware Aria Operations
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.5%probability of exploitation in the next 30 days
Higher than 39% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// .
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 24 Feb · 15:01 UTC | SecurityWeek | Broadcom patches command injection in VMware Aria CVE-2026-22719 |
| Tue 24 Feb · 16:01 UTC | Security Affairs | VMware Aria Operations must be patched after CVE-2026-22719 |
| Wed 4 Mar · 05:58 UTC | The Hacker News | CISA flags CVE-2026-22719 in Broadcom VMware Aria Operations RCE |
- CISA flags CVE-2026-22719 in Broadcom VMware Aria Operations RCEThe Hacker News · mentions it in passing
- VMware Aria Operations must be patched after CVE-2026-22719Security Affairs · mentions it in passing
- Broadcom patches command injection in VMware Aria CVE-2026-22719SecurityWeek · first in our coverage · mentions it in passing