Skip to content

CISA Flags VMware Aria Operations RCE Flaw as Exploited in Attacks

alt text

CVE-2026-22719 Command Injection KEV Listed Aria Operations

Overview

CISA added VMware Aria Operations command injection vulnerability CVE-2026-22719 (CVSS 8.1) to the Known Exploited Vulnerabilities (KEV) catalog after confirmed real-world exploitation. The flaw affects migration-related logic and can enable remote code execution during support-assisted product migration workflows.

The issue is part of a recently patched set of Aria Operations vulnerabilities and is particularly attractive to attackers because it targets a trusted management-plane function in enterprise and hybrid-cloud environments.

Technical Specifications

Attribute Details
Primary CVE CVE-2026-22719
Vulnerability Type Command injection
Severity CVSS 8.1 (High)
Affected Product VMware Aria Operations
Affected Function Support-assisted product migration logic
Exploit Condition Reachable management interface, migration workflow exposure
Exploitation Status Confirmed in the wild; listed in CISA KEV
Related CVEs CVE-2026-22720 (Stored XSS, CVSS 8.0), CVE-2026-22721 (Privilege escalation, CVSS 6.2)

Affected Products

  • VMware Aria Operations deployments in enterprise, cloud, and hybrid environments
  • Instances exposing or broadly reachable management interfaces
  • Environments performing support-assisted migration operations
  • Related affected attack surface: custom benchmark and role/privilege paths (per associated CVEs)
  • Status: Active exploitation pressure; urgent patching required

Technical Details

CVE-2026-22719 (Command Injection)

  • Vulnerability exists in migration-related request handling.
  • A remote unauthenticated actor may inject crafted arguments/shell metacharacters.
  • Successful exploitation can execute arbitrary OS commands in the appliance/service context.

CVE-2026-22720 (Stored XSS)

  • Stored script injection in custom benchmark workflows.
  • Script can execute in administrator browser sessions.
  • May enable session hijacking and unauthorized administrative actions.

CVE-2026-22721 (Privilege Escalation)

  • Privilege boundary weakness can elevate attacker capabilities.
  • Can be chained with other flaws to obtain broader platform control.

Chaining Risk

  • RCE foothold (CVE-2026-22719) can be combined with XSS and privilege escalation issues.
  • Chaining increases likelihood of full management-plane compromise and persistent access.

Attack Scenario

  1. Targeting & Reconnaissance:

    • Attacker identifies reachable Aria Operations management interfaces.

  2. Migration-Window Abuse:

    • During/around support-assisted migration, crafted HTTP requests target vulnerable migration parameters.

  3. Command Injection Execution:

    • Shell metacharacter injection triggers command execution on underlying OS/service context.

  4. Foothold Establishment:

    • Attacker deploys web shells/agents, creates backdoor users, or modifies trusted platform settings.

  5. Privilege Expansion & Lateral Movement:

    • Additional CVEs (XSS/priv-esc) are used to expand control and pivot into vSphere/cloud infrastructure.

Impact Assessment

  • Unauthorized command execution in trusted Aria management plane
  • Potential tampering with monitoring policies, alerts, and configuration state
  • Elevated risk of administrative takeover via chained vulnerabilities
  • Access to inventory, telemetry, and potentially sensitive management context
  • Increased risk of credential/session compromise via stored XSS paths
  • Platform compromise may expose multi-cloud and virtualization details
  • Disruption of monitoring and operations workflows
  • Potential destructive actions launched from trusted management infrastructure
  • Broader workload/platform outages if lateral movement succeeds

Mitigation Strategies

Patch / Upgrade

  • Apply fixes from Broadcom advisory VMSA-2026-0001
  • Upgrade Aria Operations to 8.18.6 or patched builds included with VMware Cloud / vSphere Foundation 9.0.2.0
  • Ensure remediation covers all related issues: CVE-2026-22719, CVE-2026-22720, and CVE-2026-22721

Reduce Exposure

  • Restrict management interfaces to trusted admin networks/VPN only
  • Avoid direct internet exposure and broad east-west reachability
  • Enforce least-privilege for users able to create benchmarks or run migration operations

Monitoring & Detection

  • Review logs for anomalous migration operations and suspicious command execution indicators
  • Alert on unusual HTTP patterns targeting migration-related endpoints
  • Integrate KEV guidance and updated detection signatures into threat-hunting playbooks

Hardening & Resilience

  • Segment Aria Operations from production workloads with strict firewall policies
  • Maintain tested backups and incident response procedures for management-plane compromise
  • Conduct post-patch validation and exposure scanning across all Aria instances

Resources and References

Open-Source Reporting

Last Updated: March 4, 2026