SECURELYN
Free ScanFree consultation

CVE-2026-22719

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the…

Scores

8.1
CVSS 8.1 out of 10, high severity.
18.1%
EPSS 18.1% chance of exploitation in the next 30 days.

The facts

Published
25 February 2026
Last changed
17 June 2026
NVD status
Analyzed
Severity
High, CVSS 8.1 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
Affects
  • vmware aria operations
  • vmware cloud foundation
  • vmware telco cloud infrastructure
  • vmware telco cloud platform
Known exploited
Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 March 2026.
EPSS
18.1% chance of exploitation activity in the next 30 days (percentile 97).

Is there a Securelyn advisory?

Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.

References