cbcvebase.
CVE-2026-22719
published 2026-02-25

CVE-2026-22719: VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which…

PriorityP186high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-03-24
Exploited in the wild
EPSS
17.42%
96.8th percentile
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001

Affected

10 ranges
VendorProductVersion rangeFixed in
vmwarearia_operations>= 8.0 < 8.18.68.18.6
vmwarecloud_foundation>= 4.0 < 5.2.35.2.3
vmwarecloud_foundation>= 9.0 < 9.0.2.09.0.2.0
vmwaretelco_cloud_infrastructure>= 2.0 < 5.2.35.2.3
vmwaretelco_cloud_infrastructure2.2 – 3.0
vmwaretelco_cloud_platform>= 2.0 < 5.2.35.2.3
vmwaretelco_cloud_platform4.0 – 5.1
vmwarevmware_aria_operations>= 8.18.x < 8.18.68.18.6
vmwarevmware_cloud_foundation_operations>= 4.0 < 5.2.35.2.3
vmwarevmware_cloud_foundation_operations>= 9.0 < 9.0.29.0.2

Detection & IOCsextracted from sources · hover to see the quote

filenamearia-ops-rce-workaround.sh
path/usr/lib/vmware-casa/migration/vmware-casa-migration-service.sh
path/usr/lib/vmware-casa/bin/vmware-casa-workflow.sh
commandNOPASSWD: /usr/lib/vmware-casa/bin/vmware-casa-workflow.sh
  • Monitor for unauthenticated command injection attempts targeting VMware Aria Operations during support-assisted product migration workflows; exploitation occurs while migration is in progress.
  • Alert on execution of vmware-casa-migration-service.sh or vmware-casa-workflow.sh from unexpected or unauthenticated contexts, especially invocations running as root via sudoers NOPASSWD.
  • Affected versions are Aria Operations 8 through 8.18.5 and 9 through 9.0.1; prioritize detection and patching on these version ranges.
  • Check sudoers configuration on Aria Operations nodes for the NOPASSWD entry permitting vmware-casa-workflow.sh to run as root, which is the abusable privilege escalation path.
  • ·Exploitation is only possible while support-assisted product migration is actively in progress; attack surface is conditional on this operational state.
  • ·The workaround script must be executed as root on EACH Aria Operations appliance node individually; partial deployment leaves nodes exposed.

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck8.1HIGH
cisa8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.