Actively exploited · Published Feb 25, 2026 · Assigned by vmware
CVE-2026-22719VMware Aria Operations command injection vulnerability
High 8.1 Exploited
In plain English
A high-severity command injection in Telco Cloud Infrastructure from VMware. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2026). The chance it is exploited in the next 30 days is estimated at 18.3% (higher than 97% of all known vulnerabilities). Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Mar 24, 2026.
Official description
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| VMware | VMware Aria Operations | 8.18.x – before 8.18.6 |
| VMware | VMware Cloud Foundation Operations | 9.0 – before 9.0.24.0 – before 5.2.3 |
| VMware | Telco Cloud Platform | 2.0 – before 5.2.3 |
| VMware | Telco Cloud Infrastructure | 2.0 – before 5.2.3 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- VMSA-2026-0001: VMware Aria Operations updates (includes CVE-2026-22719) vendor-advisory
- KB430349: Workaround instructions for CVE-2026-22719 mitigation
- VMware Aria Operations 8.18.6 Release Notes (resolves CVE-2026-22719) release-notes
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22719 government-resource