CVE-2026-22719

9.5 CISA KEV

VMware · Aria Operations

VMware Aria Operations contains a command injection vulnerability that could allow an attacker to execute arbitrary commands on the affected system.

Executive summary

VMware Aria Operations is susceptible to a critical command injection vulnerability that could allow an attacker to achieve full system compromise by executing unauthorized code.

Vulnerability

This vulnerability is a command injection flaw, typically occurring when an application passes unsafe user-supplied data to a system shell. This allows an attacker to break out of the intended application logic and execute arbitrary operating system commands.

Business impact

Command injection is one of the most dangerous classes of vulnerabilities. A successful exploit could allow an attacker to gain a persistent foothold in the environment, steal sensitive operational data, or deploy ransomware. The CVSS score of 8.1 underscores the high severity and the potential for total loss of system integrity and confidentiality.

Remediation

Immediate Action: Apply the security patches provided by VMware (Broadcom) for Aria Operations immediately.

Proactive Monitoring: Inspect system logs for the execution of unexpected shell commands, especially those originating from web service accounts (e.g., 'www-data' or 'tomcat').

Compensating Controls: Ensure that Aria Operations instances are not exposed directly to the public internet and are protected by robust network segmentation and a WAF.

Exploitation status

Public Exploit Available: false

Analyst recommendation

The severity of a command injection vulnerability in a management platform like Aria Operations cannot be overstated. Organizations must prioritize this update above standard maintenance cycles. Immediate patching is the primary recommendation to prevent unauthorized actors from seizing control of critical infrastructure monitoring tools.

More VMware CVEs all →

History

  1. Disclosed CVE record published
  2. Published in the daily brief high section
  3. Published in the daily brief high section
  4. Published in the daily brief kev section
  5. Published in the daily brief kev section
  6. Published in the daily brief kev section
  7. Published in the daily brief kev section
  8. Published in the daily brief kev section
  9. Published in the daily brief kev section
  10. Published in the daily brief kev section
  11. Published in the daily brief kev section
  12. Published in the daily brief kev section
  13. Published in the daily brief kev section
  14. Published in the daily brief kev section
  15. Published in the daily brief kev section
  16. Published in the daily brief kev section
  17. Published in the daily brief kev section
  18. Published in the daily brief kev section
  19. Published in the daily brief kev section
  20. Published in the daily brief kev section
  21. Published in the daily brief kev section
  22. Published in the daily brief kev section
  23. Published in the daily brief kev section
  24. Fix documented version 8.18.6 per CVE record