CISA Adds Actively Exploited VMware Aria Operations Flaw to KEV Catalog, Gives Federal Agencies Three Weeks to Patch
A command injection vulnerability in Broadcom's VMware Aria Operations is under active exploitation, prompting CISA to set a March 24 federal remediation deadline.
Overview
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-22719, a high-severity command injection flaw in Broadcom’s VMware Aria Operations, to its Known Exploited Vulnerabilities (KEV) catalog on March 3, 2026. The listing confirms active exploitation in the wild and compels Federal Civilian Executive Branch (FCEB) agencies to apply patches or workarounds by March 24, as reported by The Hacker News.
The vulnerability is part of a broader advisory, VMSA-2026-0001, that Broadcom originally published on February 24, 2026, covering three distinct flaws in the Aria Operations platform.
What We Know
The Vulnerability
CVE-2026-22719 carries a CVSS score of 8.1 and is classified as a command injection vulnerability. According to Broadcom’s advisory, a malicious unauthenticated actor may exploit the issue to execute arbitrary commands during support-assisted product migration, potentially leading to remote code execution.
The flaw is notable because it requires no authentication, lowering the barrier for exploitation. However, the attack surface appears to be limited to environments where a support-assisted migration is in progress, which may constrain the window of opportunity for attackers.
Affected Products
The vulnerability spans a wide range of Broadcom’s VMware product portfolio, as detailed in Broadcom’s security advisory:
- VMware Aria Operations 8.x (up to version 8.18.5) and 9.x (up to version 9.0.1)
- VMware Cloud Foundation versions 9.x, 5.x, and 4.x
- VMware Telco Cloud Platform 5.x and 4.x
- VMware Telco Cloud Infrastructure 3.x and 2.x
Aria Operations is widely deployed across enterprise data centers for infrastructure monitoring and capacity planning, meaning the potential blast radius covers a significant portion of virtualized environments worldwide.
Two Additional Flaws in the Same Advisory
VMSA-2026-0001 also addresses two related vulnerabilities. CVE-2026-22720, a stored cross-site scripting (XSS) flaw with a CVSS score of 8.0, allows an attacker with privileges to create custom benchmarks to inject scripts that perform administrative actions. CVE-2026-22721, a privilege escalation flaw rated at CVSS 6.2, enables privileged vCenter users to obtain administrative access in VMware Aria Operations. Neither of these two flaws has documented workarounds; patching is the only remediation path, according to Broadcom.
Patched Versions and Workarounds
Broadcom has released fixes in Aria Operations 8.18.6 and 9.0.2, along with corresponding updates for VMware Cloud Foundation and vSphere Foundation. For organizations that cannot patch immediately, Broadcom has published a workaround script, aria-ops-rce-workaround.sh, that must be run as root on each Aria Operations Virtual Appliance node. The script only addresses CVE-2026-22719 and does not mitigate the XSS or privilege escalation flaws, as noted by Vulert.
Discovery and Disclosure
CVE-2026-22720 was credited to Tobias Anders of Deutsche Telekom Security GmbH. CVE-2026-22721 was credited to Sven Nobis and Lorin Lehawany of ERNW Enno Rey Netzwerke GmbH. The discoverer of CVE-2026-22719 was not publicly identified; the vulnerability was privately reported to Broadcom, per the advisory.
What We Don’t Know
Several significant details remain undisclosed. No threat actor has been publicly attributed to the exploitation activity. Broadcom has acknowledged awareness of reports of potential exploitation but stated it cannot independently confirm their validity, as reported by SecurityWeek. The scale of exploitation, the number of compromised environments, and the specific attack chains being used have not been made public. No proof-of-concept exploit code has surfaced publicly at the time of writing.
Analysis
VMware infrastructure has become a recurring target for both nation-state actors and ransomware operators. ESXi hypervisors were a favored entry point for multiple threat groups throughout 2025, and Aria Operations, which sits at the management layer with broad visibility into virtualized environments, represents a high-value target for attackers seeking lateral movement or persistent access.
The unauthenticated nature of CVE-2026-22719 makes it particularly concerning. While the requirement for a migration process to be in progress may limit opportunistic scanning, organizations in the midst of Broadcom’s ongoing product consolidation and rebranding may be especially vulnerable, given that migration activities have increased across the customer base since Broadcom completed its VMware acquisition.
FCEB agencies face a hard March 24 deadline under Binding Operational Directive 22-01. Private-sector organizations, though not legally bound by CISA’s directive, would be prudent to treat the deadline as their own, given the confirmed exploitation status.