---
title: "Aria Operations CVE-2026-22719: Exploited Command Injection"
url: https://erroneo.us/security/briefs/vmware-aria-operations-cve-2026-22719-command-injection/
description: "Unauthenticated command injection in VMware Aria Operations during support-assisted migration, in CISA KEV. Fixed in 8.18.6 and 9.0.2.0; go to 8.18.7."
type: security-brief
section: "Security Digest"
date_published: 2026-02-24
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-22719"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Aria Operations CVE-2026-22719: Exploited Command Injection

**Verdict: Check exposure.** The bug only works while a support-assisted migration is running and the fix is eight months old, but Aria Operations holds the keys to your vSphere estate; confirm every node is on 8.18.7 or a fixed 9.x build and review any migration done on an older one.

- **Who must act:** Teams running VMware Aria Operations 8.x before 8.18.6, VCF Operations 9.0 before 9.0.2.0, or VCF 4.x/5.x and Telco Cloud editions with an unpatched Aria Operations component, especially if a support-assisted migration ran on such a build.
- **Who can relax:** Teams with no Aria Operations or VCF Operations, and those already on 8.18.7, 9.0.2.0 EP2 or 9.1.0.0 whose appliances only admin networks can reach.
- **Affected:** VMware Aria Operations 8.x before 8.18.6; VMware Cloud Foundation Operations 9.0 before 9.0.2.0; VMware Cloud Foundation 4.x and 5.x (Aria Operations component) before 8.18.6; VMware Telco Cloud Platform 4.x/5.x and Telco Cloud Infrastructure 2.x/3.x (see Broadcom KB428241)
- **Fixed:** VMware Aria Operations 8.18.6 (Feb 24, 2026); VCF Operations 9.0.2.0; Recommended now: Aria Operations 8.18.7, or VCF Operations 9.0.2.0 EP2 / 9.1.0.0, which also fix VMSA-2026-0004
- **CVEs:** CVE-2026-22719
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every Aria Operations and VCF Operations node and record its version and build.
2. Upgrade 8.x to 8.18.7 and 9.x to 9.0.2.0 EP2 or 9.1.0.0; 8.18.6 and 9.0.2.0 are the minimum for this CVE.
3. If you cannot upgrade yet, run aria-ops-rce-workaround.sh from KB430349 as root on every node; it does not cover CVE-2026-22720 or CVE-2026-22721.
4. Do not start a support-assisted migration on an unpatched build, and keep the appliances reachable only from admin networks.
5. If a migration ran on an unpatched build, rotate the vCenter, cloud and adapter credentials stored in Aria Operations.

### How to check if you are affected

- Find out whether a support-assisted migration ran on any node before it reached 8.18.6 or 9.0.2.0, and whether untrusted networks could reach it at the time.
- On each node, review root's crontab, /etc/cron.d, authorized_keys and recent logins (last -a) for anything you did not set up.
- Check firewall logs for unexpected outbound connections from Aria Operations appliances.
- Review vCenter events for unusual actions by the account Aria Operations uses; Broadcom had published no IOCs as of Oct 23, 2026.

## What happened

On February 24, 2026, Broadcom published [VMSA-2026-0001](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947) and released VMware Aria Operations 8.18.6. The advisory fixes three bugs. The serious one is CVE-2026-22719, a command injection (CWE-77). Broadcom says an unauthenticated attacker "may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress." Broadcom scores it CVSS 3.1 8.1. The high attack complexity reflects that migration condition. The other two are a stored XSS (CVE-2026-22720) and a privilege escalation (CVE-2026-22721), which need a login.

On March 3, Broadcom updated the advisory: it "is aware of reports of potential exploitation of CVE-2026-22719 in the wild," but cannot independently confirm them. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22719) the same day, with a March 24 deadline. [SecurityWeek](https://www.securityweek.com/vmware-aria-operations-vulnerability-exploited-in-the-wild/) found no public information about the attacks and said it was unclear whether the bug was used as a zero-day. No attacker, technique or indicator has been published as of October 23, 2026.

## Who is affected

Per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-22719) and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-22719): Aria Operations 8.x before 8.18.6, VCF Operations 9.0 before 9.0.2.0, and VCF 4.x and 5.x before 5.2.3, plus Telco Cloud Platform and Telco Cloud Infrastructure. [Field Effect](https://fieldeffect.com/blog/cisa-rce-vmware-aria-operations) explains the condition: support-assisted migration is a workflow run with VMware Support that turns on components that are normally inactive, and the vulnerable code is reachable only while it runs.

## Do you really need to act?

Check, don't panic. Most appliances are never in a migration, and the fix is eight months old. But Aria Operations stores credentials for vCenter and the other systems it monitors, so a foothold there reaches far. Two more points matter. First, [VMSA-2026-0004](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513) (June 8, 2026) fixed three stored XSS bugs scored 8.0. The full 8.x fix is 8.18.7, so 8.18.6 is no longer the target. Second, the product already had a KEV entry: [CVE-2025-41244](https://www.cve.org/CVERecord?id=CVE-2025-41244), a local privilege escalation in Aria Operations and VMware Tools, fixed in 8.18.5 and in KEV since October 2025.

## What to do now

1. List every Aria Operations and VCF Operations node and its version and build.
2. Upgrade to 8.18.7, or to 9.0.2.0 EP2 or 9.1.0.0 on 9.x. The [8.18.6 release notes](https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html) say to run the Pre-Upgrade Assessment Tool and snapshot each node first.
3. If an upgrade must wait, copy `aria-ops-rce-workaround.sh` from [KB430349](https://knowledge.broadcom.com/external/article/430349) to each node, then run `chmod a+x ./aria-ops-rce-workaround.sh && ./aria-ops-rce-workaround.sh` as root. Broadcom calls it temporary.
4. Patch before any support-assisted migration, and limit appliance access to admin networks.

## How to tell if you were hit

Start with your change records: did a support-assisted migration run on a build older than 8.18.6 or 9.0.2.0, and could untrusted networks reach the appliance then? If so, check each node. Run `crontab -l`, `ls -la /etc/cron.d`, `cat /root/.ssh/authorized_keys` and `last -a`, and look for anything you did not set up. Review firewall logs for outbound connections from the appliances, and vCenter events for unusual actions by the Aria Operations service account. If anything is off, rebuild the node and rotate every credential it stores.

## Timeline

- Feb 24, 2026 — Broadcom publishes VMSA-2026-0001 and Aria Operations 8.18.6.
- Feb 25, 2026 — The CVE record is published.
- Mar 3, 2026 — Broadcom notes reports of exploitation. CISA adds the CVE to KEV.
- Mar 24, 2026 — CISA's deadline for federal agencies.
- Jun 8, 2026 — VMSA-2026-0004 ships further Aria Operations fixes, through 8.18.7.

## Sources

1. [Broadcom — VMSA-2026-0001: VMware Aria Operations updates address multiple vulnerabilities (CVE-2026-22719, CVE-2026-22720, CVE-2026-22721)](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947)
2. [Broadcom — KB430349: Workaround instructions to address CVE-2026-22719 in Aria Operations 8.18.x and 9.0.x](https://knowledge.broadcom.com/external/article/430349)
3. [Broadcom — VMware Aria Operations 8.18.6 release notes](https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html)
4. [CVE record — CVE-2026-22719](https://www.cve.org/CVERecord?id=CVE-2026-22719)
5. [NVD — CVE-2026-22719](https://nvd.nist.gov/vuln/detail/CVE-2026-22719)
6. [CISA — Known Exploited Vulnerabilities: CVE-2026-22719](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22719)
7. [Broadcom — VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513)
8. [CVE record — CVE-2025-41244](https://www.cve.org/CVERecord?id=CVE-2025-41244)
9. [Field Effect — CISA flags exploited RCE in VMware Aria Operations](https://fieldeffect.com/blog/cisa-rce-vmware-aria-operations)
10. [SecurityWeek — VMware Aria Operations vulnerability exploited in the wild](https://www.securityweek.com/vmware-aria-operations-vulnerability-exploited-in-the-wild/)

---
Source page: https://erroneo.us/security/briefs/vmware-aria-operations-cve-2026-22719-command-injection/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt