Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
HighCISA KEVExploited in the wildPublic exploit

Unauthenticated Command Injection RCE in VMware Aria Operations

IdentifiersCVE-2026-22719CWE-77· Improper Neutralization of Special…Also known asvmsa_2026_0001

CVE-2026-22719 is a command injection vulnerability in Broadcom VMware Aria Operations (formerly vRealize Operations/vROps). According to Broadcom, a malicious unauthenticated actor can exploit the flaw to execute arbitrary commands, potentially resulting in remote code execution on the Aria Operations appliance. Exploitation is tied to a specific operational state: the vulnerable code path is reachable while a support-assisted product migration is in progress. Reported affected versions include Aria Operations 8.x through 8.18.5 and 9.x through 9.0.1, with related exposure also noted in bundled platforms that include Aria Operations, such as VMware Cloud Foundation, VMware vSphere Foundation, and certain VMware Telco Cloud offerings. Public reporting does not provide deeper technical detail on the exact vulnerable function or parameter handling beyond Broadcom’s classification of the issue as command injection.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary commands on the VMware Aria Operations appliance and may lead to full remote code execution. Because Aria Operations is a high-trust management and monitoring platform, compromise can expose sensitive operational data and create a foothold in the management plane, with potential downstream impact on managed virtual, cloud, and hybrid infrastructure. CISA added the vulnerability to the KEV catalog based on evidence of active exploitation, indicating real-world attacker interest.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, apply Broadcom’s temporary workaround for CVE-2026-22719. The documented workaround uses the script aria-ops-rce-workaround.sh, which must be copied to and executed as root on each Aria Operations Virtual Appliance node. Broadcom states this workaround is intended only for CVE-2026-22719 and does not mitigate CVE-2026-22720 or CVE-2026-22721. Additional defensive measures supported by the content include restricting Aria Operations management-plane access to trusted administrative networks or VPN-only access, tightening change control around migration windows, and increasing monitoring during support-assisted migration activity.

Remediation

Patch, then assume compromise.

Apply Broadcom/VMware fixed releases referenced in VMSA-2026-0001 and the associated response matrix. The content indicates fixed versions include VMware Aria Operations 8.18.6 and 9.0.2, with bundled platform fixes including VMware Cloud Foundation / VMware vSphere Foundation 9.0.2.0 and VMware Cloud Foundation 5.2.3 where applicable. For other affected bundled offerings, apply the specific Broadcom KB-directed fixes identified in the advisory response matrix. Upgrade is required to fully remediate related issues in the advisory set.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
BroadcomAria Operationsapplication
BroadcomCloud Foundationapplication
BroadcomTelco Cloud Infrastructureapplication
BroadcomTelco Cloud Platformapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity79

Community discussion across Reddit, Mastodon, and other social sources.