{"cve_id":"CVE-2026-22719","summary":"VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. \n\nTo remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 \n\nWorkarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001","cvss":8.1,"cvss_version":3.0,"cvss_v2":null,"cvss_v3":8.1,"epss":0.02066,"ranking_epss":0.83888,"kev":true,"propose_action":"Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.","ransomware_campaign":"Unknown","references":["https://knowledge.broadcom.com/external/article/430349","https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947","https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22719"],"published_time":"2026-02-25T20:23:46","cpes":["cpe:2.3:a:vmware:aria_operations:8.0","cpe:2.3:a:vmware:aria_operations:8.10.0","cpe:2.3:a:vmware:aria_operations:8.12.0","cpe:2.3:a:vmware:aria_operations:8.14.0","cpe:2.3:a:vmware:aria_operations:8.14.1","cpe:2.3:a:vmware:aria_operations:8.16.0","cpe:2.3:a:vmware:aria_operations:8.16.1","cpe:2.3:a:vmware:aria_operations:8.17.1","cpe:2.3:a:vmware:aria_operations:8.17.2","cpe:2.3:a:vmware:aria_operations:8.18","cpe:2.3:a:vmware:aria_operations:8.18.1","cpe:2.3:a:vmware:aria_operations:8.18.2","cpe:2.3:a:vmware:aria_operations:8.18.3","cpe:2.3:a:vmware:aria_operations:8.18.4","cpe:2.3:a:vmware:aria_operations:8.18.5","cpe:2.3:a:vmware:aria_operations:8.6.0","cpe:2.3:a:vmware:cloud_foundation:4.0","cpe:2.3:a:vmware:cloud_foundation:4.0.1","cpe:2.3:a:vmware:cloud_foundation:4.1","cpe:2.3:a:vmware:cloud_foundation:4.1.0.1","cpe:2.3:a:vmware:cloud_foundation:4.2","cpe:2.3:a:vmware:cloud_foundation:4.2.1","cpe:2.3:a:vmware:cloud_foundation:4.3","cpe:2.3:a:vmware:cloud_foundation:4.3.1","cpe:2.3:a:vmware:cloud_foundation:4.3.11","cpe:2.3:a:vmware:cloud_foundation:4.4","cpe:2.3:a:vmware:cloud_foundation:4.4.1","cpe:2.3:a:vmware:cloud_foundation:4.4.1.1","cpe:2.3:a:vmware:cloud_foundation:4.5","cpe:2.3:a:vmware:cloud_foundation:4.5.1","cpe:2.3:a:vmware:cloud_foundation:4.5.2","cpe:2.3:a:vmware:cloud_foundation:5.0","cpe:2.3:a:vmware:cloud_foundation:5.1","cpe:2.3:a:vmware:cloud_foundation:5.1.1","cpe:2.3:a:vmware:cloud_foundation:5.2","cpe:2.3:a:vmware:cloud_foundation:5.2.1","cpe:2.3:a:vmware:cloud_foundation:5.2.1.1","cpe:2.3:a:vmware:cloud_foundation:5.2.1.2","cpe:2.3:a:vmware:cloud_foundation:5.2.2","cpe:2.3:a:vmware:cloud_foundation:9.0","cpe:2.3:a:vmware:cloud_foundation:9.0.1.0","cpe:2.3:a:vmware:telco_cloud_infrastructure:2.2","cpe:2.3:a:vmware:telco_cloud_infrastructure:2.5","cpe:2.3:a:vmware:telco_cloud_infrastructure:2.7","cpe:2.3:a:vmware:telco_cloud_infrastructure:3.0","cpe:2.3:a:vmware:telco_cloud_platform:4.0","cpe:2.3:a:vmware:telco_cloud_platform:4.0.1","cpe:2.3:a:vmware:telco_cloud_platform:5.0","cpe:2.3:a:vmware:telco_cloud_platform:5.0.1"]}