A U.S. cybersecurity agency has added a high-severity VMware vulnerability to its catalog due to active exploitation. The flaw allows unauthenticated attackers to execute arbitrary commands for potential remote code execution. Patches and a temporary workaround are available for affected products. Federal agencies are mandated to apply fixes by a specific deadline. The article covers the vulnerability's details, the response from authorities and the vendor, and the current lack of information on the exploitation campaigns.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a recently disclosed security flaw impacting Broadcom VMware Aria Operations to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild.
The high-severity vulnerability, CVE-2026-22719 (CVSS score: 8.1), has been described as a case of command injection that could allow an unauthenticated attacker to execute arbitrary commands.
"A malicious unauthenticated actor may exploit this issue to execute arbitrary commands, which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress," the company said in an advisory released late last month.
The shortcoming was addressed, along withCVE-2026-22720, a stored cross-site scripting vulnerability, and CVE-2026-22721, a privilege escalation vulnerability that could result in administrative access. It impacts the following products -
- VMware Cloud Foundation and VMware vSphere Foundation 9.x.x.x - Fixed in 9.0.2.0
- VMware Aria Operations 8.x - Fixed in 8.18.6
Customers who cannot apply the patch immediately can download and run a shell script ("aria-ops-rce-workaround.sh") as root from each Aria Operations Virtual Appliance node.
There are currently no details on how the vulnerability is being exploited in the wild, who is behind it, and the scale of such efforts.
"Broadcom is aware of reports of potential exploitation of CVE-2026-22719 in the wild, but we cannot independently confirm their validity," the company noted in an update to its bulletin.
In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are required to apply the fixes by March 24, 2026.
Meridiano
