Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-22719

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.  To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:31a268d37d2eeef3509fee2f88cc8808c2431bd24db95cbc5460ca5dca779f87
Known exploited
CISA KEV
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 4 assertions

{"defaultStatus":"affected","packageName":"vmware-telco-cloud-infrastructure","product":"Telco Cloud Infrastructure","vendor":"VMware","versions":[{"lessThan":"5.2.3","status":"affected","version":"2.0","versionType":"custom"},{"status":"unaffected","version":"5.2.3"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5285238748da05a8c5d347d5a9a370afa2e73572721b6d7f8d7ec640135f0c1f · sha256:9ff63d0aea54e300… · /containers/cna/affected/3

{"defaultStatus":"affected","packageName":"vmware-telco-cloud-platform","product":"Telco Cloud Platform","vendor":"VMware","versions":[{"lessThan":"5.2.3","status":"affected","version":"2.0","versionType":"custom"},{"status":"unaffected","version":"5.2.3","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5285238748da05a8c5d347d5a9a370afa2e73572721b6d7f8d7ec640135f0c1f · sha256:9ff63d0aea54e300… · /containers/cna/affected/2

{"defaultStatus":"affected","packageName":"VMware Cloud Foundation Operations","product":"VMware Cloud Foundation Operations","vendor":"VMware","versions":[{"lessThan":"9.0.2","status":"affected","version":"9.0","versionType":"custom"},{"status":"unaffected","version":"9.0.2","versionType":"custom"},{"lessThan":"5.2.3","status":"affected","version":"4.0","versionType":"custom"},{"status":"unaffected","version":"5.2.3"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5285238748da05a8c5d347d5a9a370afa2e73572721b6d7f8d7ec640135f0c1f · sha256:9ff63d0aea54e300… · /containers/cna/affected/1

{"defaultStatus":"affected","packageName":"VMware Aria Operations","product":"VMware Aria Operations","vendor":"VMware","versions":[{"lessThan":"8.18.6","status":"affected","version":"8.18.x","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5285238748da05a8c5d347d5a9a370afa2e73572721b6d7f8d7ec640135f0c1f · sha256:9ff63d0aea54e300… · /containers/cna/affected/0

Affected products and versions

4 source assertions
{"defaultStatus":"affected","packageName":"vmware-telco-cloud-infrastructure","product":"Telco Cloud Infrastructure","vendor":"VMware","versions":[{"lessThan":"5.2.3","status":"affected","version":"2.0","versionType":"custom"},{"status":"unaffected","version":"5.2.3"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5285238748da05a8c5d347d5a9a370afa2e73572721b6d7f8d7ec640135f0c1f · sha256:9ff63d0aea54e300… · /containers/cna/affected/3
{"defaultStatus":"affected","packageName":"vmware-telco-cloud-platform","product":"Telco Cloud Platform","vendor":"VMware","versions":[{"lessThan":"5.2.3","status":"affected","version":"2.0","versionType":"custom"},{"status":"unaffected","version":"5.2.3","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5285238748da05a8c5d347d5a9a370afa2e73572721b6d7f8d7ec640135f0c1f · sha256:9ff63d0aea54e300… · /containers/cna/affected/2
{"defaultStatus":"affected","packageName":"VMware Cloud Foundation Operations","product":"VMware Cloud Foundation Operations","vendor":"VMware","versions":[{"lessThan":"9.0.2","status":"affected","version":"9.0","versionType":"custom"},{"status":"unaffected","version":"9.0.2","versionType":"custom"},{"lessThan":"5.2.3","status":"affected","version":"4.0","versionType":"custom"},{"status":"unaffected","version":"5.2.3"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5285238748da05a8c5d347d5a9a370afa2e73572721b6d7f8d7ec640135f0c1f · sha256:9ff63d0aea54e300… · /containers/cna/affected/1
{"defaultStatus":"affected","packageName":"VMware Aria Operations","product":"VMware Aria Operations","vendor":"VMware","versions":[{"lessThan":"8.18.6","status":"affected","version":"8.18.x","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5285238748da05a8c5d347d5a9a370afa2e73572721b6d7f8d7ec640135f0c1f · sha256:9ff63d0aea54e300… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:5285238748da05a8c5d347d5a9a370afa2e73572721b6d7f8d7ec640135f0c1f · sha256:9ff63d0aea54e300… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-77","description":"CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:5285238748da05a8c5d347d5a9a370afa2e73572721b6d7f8d7ec640135f0c1f · sha256:9ff63d0aea54e300… · /containers/adp/0/problemTypes/0/descriptions/0

Known exploitation assertions

2 source assertions
{"cwes":["CWE-77"],"dateAdded":"2026-03-03","dueDate":"2026-03-24","knownRansomwareCampaignUse":"Unknown","notes":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ; https://knowledge.broadcom.com/external/article/430349 ; https://nvd.nist.gov/vuln/detail/CVE-2026-22719","product":"VMware Aria Operations","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","shortDescription":"Broadcom VMware Aria Oper…
  • cisa_kev_jsonknown_exploited
    urn:baitaphish:normalized-source-record:v2:743848b81cc460f1fc5a02bd96e35450f16c01a75cf4fd8d09dd668c5a7258b5 · sha256:16acee8334e59e44… · /vulnerabilities/126
    Open source location →
{"cwes":["CWE-77"],"dateAdded":"2026-03-03","dueDate":"2026-03-24","knownRansomwareCampaignUse":"Unknown","notes":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ; https://knowledge.broadcom.com/external/article/430349 ; https://nvd.nist.gov/vuln/detail/CVE-2026-22719","product":"VMware Aria Operations","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","shortDescription":"Broadcom VMware Aria Oper…
  • cisa_kev_jsonknown_exploited
    urn:baitaphish:normalized-source-record:v2:d945bbacd75cf95acb5b476cce2df57b4c347bb01fd55ea4decfc04cee50912c · sha256:635dff916c4092c0… · /vulnerabilities/129
    Open source location →

Source references

4 source assertions
{"name":"KB430349: Workaround instructions for CVE-2026-22719","tags":["mitigation"],"url":"https://knowledge.broadcom.com/external/article/430349"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5285238748da05a8c5d347d5a9a370afa2e73572721b6d7f8d7ec640135f0c1f · sha256:9ff63d0aea54e300… · /containers/cna/references/1
{"name":"VMSA-2026-0001: VMware Aria Operations updates (includes CVE-2026-22719)","tags":["vendor-advisory"],"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5285238748da05a8c5d347d5a9a370afa2e73572721b6d7f8d7ec640135f0c1f · sha256:9ff63d0aea54e300… · /containers/cna/references/0
{"name":"VMware Aria Operations 8.18.6 Release Notes (resolves CVE-2026-22719)","tags":["release-notes"],"url":"https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5285238748da05a8c5d347d5a9a370afa2e73572721b6d7f8d7ec640135f0c1f · sha256:9ff63d0aea54e300… · /containers/cna/references/2
{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22719"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5285238748da05a8c5d347d5a9a370afa2e73572721b6d7f8d7ec640135f0c1f · sha256:9ff63d0aea54e300… · /containers/adp/0/references/0

Attribution and limitations

  • CISA Known Exploited Vulnerabilities JSON: CISA named for provenance; do not use CISA/DHS marks or imply endorsement Source →
  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer