CVE-2026-22721

CWE-269 — Improper Privilege Management3 documents3 sources
Severity
7.2HIGH
EPSS
0.0%
top 91.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Vmware Vmware Aria OperationsVmware Vmware Cloud FoundationVmware Vmware Telco Cloud Infrastructure+5 more
Timeline
PublishedFeb 25

Description

VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found in VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 .

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:LExploitability: 0.7 | Impact: 5.5

Affected Packages8 packages

▶NVDvmware/aria_operations8.0 — 8.18.6
▶CVEListV5vmware/vmware_aria_operations8.18.0 — 8.18.6
▶NVDvmware/cloud_foundation4.0 — 5.2.3+1
▶CVEListV5vmware/vmware_cloud_foundation4.0 — 5.2.3+1
▶CVEListV5vmware/vmware_telco_cloud_platform4.0 — 5.2.3

Patches

Patch: support.broadcom.com ↗

🔴Vulnerability Details

2
CVEList
VMware Aria Operations privilege escalation vulnerability↗2026-02-25
▶
GHSA
GHSA-p743-h3f6-5f74: VMware Aria Operations contains a privilege escalation vulnerability↗2026-02-25
▶
CVE-2026-22721 (HIGH CVSS 7.2) | VMware Aria Operations contains a p | cvebase.io