Vulnerability · Published Feb 25, 2026 · Assigned by vmware

CVE-2026-22721VMware Aria Operations privilege escalation vulnerability

Medium 6.2

In plain English

A medium-severity privilege mismanagement in VMware Aria Operations from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)6.2Medium

Exploit odds (30 days)0.7%top 45.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found in VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 .

Affected products (as reported)

Vendor	Product	Versions
VMware	VMware Aria Operations	8.18.0 – before 8.18.6
VMware	VMware Cloud Foundation	4.0 – before 5.2.39.0 – before 9.0.2
VMware	VMware Telco Cloud Platform	4.0 – before 5.2.3
VMware	VMware Telco Cloud Infrastructure	2.0 – before 5.2.3

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

References

VMSA-2026-0001: VMware Aria Operations updates (includes CVE-2026-22721) vendor-advisory
VMware Aria Operations 8.18.6 Release Notes (resolves CVE-2026-22721) release-notes