VMware Aria Operations Vulnerability Added to CISA Known Exploited Vulnerabilities Catalog (CVE-2026-22719)

CISA warns users about an actively exploited vulnerability in VMware Aria Operations by adding it to its Known Exploited Vulnerabilities Catalog. Tracked as CVE-2026-22719, CISA urged users to patch the vulnerability before March 24, 2026. Successful exploitation of this vulnerability may lead to the disclosure of sensitive information.

VMware Aria Operations is an AI-powered, unified IT management platform for monitoring, troubleshooting, and optimizing private, hybrid, and multi-cloud environments. It provides visibility into compute, storage, networking, and applications, enabling automated performance optimization, capacity planning, and compliance across VMware and public clouds.

Vulnerability Details

Broadcom has assigned an Important severity rating to the vulnerability, with a maximum CVSSv3 base score of 8.1. A malicious, unauthenticated actor may exploit the command injection vulnerability to execute arbitrary commands, potentially leading to remote code execution in VMware Aria Operations during support-assisted product migration.

Affected Products and Fixed Versions

For more information about the mitigation, please refer to VMware Security Advisory (VMSA-2026-0001).

Workaround

The vendor suggests the following steps for users who cannot apply the patch immediately:

1. Download the attached aria-ops-rce-workaround.sh script.
2. Copy the script to each Aria Operations Virtual Appliance node:

scp aria-ops-rce-workaround.sh root@OPS__NODE_FQDN_OR_IP:/root/

3. Run the following commands on each node:

ssh root@OPS_NODE_FQDN_OR_IP
cd /root/
chmod a+x ./aria-ops-rce-workaround.sh
./aria-ops-rce-workaround.sh

Qualys Detection

Qualys customers can scan their devices with QID 733801 to detect vulnerable assets.

Please continue to follow Qualys Threat Protection for more coverage of the latest vulnerabilities.

References
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947