CISA Flags Critical Remote Code Execution Vulnerability in VMware Aria Operations as Actively Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency has issued a high priority warning after adding a serious security flaw in Broadcoms VMware Aria Operations platform to its Known Exploited Vulnerabilities catalog. Tracked as CVE-2026-22719, the command injection vulnerability carries a CVSS score of 8.1 and enables unauthenticated remote attackers to execute arbitrary commands, potentially achieving full remote code execution on affected systems.

This development marks a significant escalation because the flaw is already being used in real world attacks. Organizations running the popular IT operations management solution must act immediately to protect their infrastructure monitoring environments.

What Is VMware Aria Operations?

VMware Aria Operations, formerly known as vRealize Operations, serves as a comprehensive monitoring and analytics platform for modern enterprise environments. It delivers real time visibility into the performance, capacity, and health of physical servers, virtual machines, storage systems, networks, and cloud workloads. Large organizations worldwide rely on it to optimize resource usage, detect anomalies, automate troubleshooting, and maintain compliance across hybrid and multi cloud setups.

The platform forms a central nervous system for many IT departments. Any compromise can therefore expose sensitive operational intelligence and create pathways for deeper network infiltration.

Technical Details of CVE-2026-22719

The vulnerability stems from improper input validation in components responsible for support assisted product migration processes. During these specific migration activities, the system fails to sanitize certain command parameters. As a result, a remote attacker who reaches the affected service can inject malicious operating system commands.

Successful exploitation grants the attacker the ability to run arbitrary code with elevated privileges on the Aria Operations appliance. Because the attack requires no authentication, any exposed instance becomes an immediate target. The flaw exists only while support assisted migration workflows are active, but this window is common during upgrades, version transitions, or troubleshooting sessions initiated with vendor support.

Exploitation in the Wild

CISA confirmed active exploitation of CVE-2026-22719 on March 3, 2026, prompting its rapid addition to the Known Exploited Vulnerabilities list. Broadcom has acknowledged public reports of attacks but stated it could not independently verify every claim at the time of its initial advisory.

Attackers typically scan for internet facing Aria Operations instances and trigger the command injection during migration related service calls. Once inside, they can establish persistent access, deploy additional tools, move laterally to connected virtual infrastructure, or exfiltrate configuration data that reveals the entire enterprise estate.

CISA Action and the Known Exploited Vulnerabilities Catalog

The Known Exploited Vulnerabilities catalog serves as the federal governments authoritative list of flaws confirmed in active use by threat actors. Inclusion forces federal civilian agencies to remediate by a strict deadline. For CVE-2026-22719, that deadline is March 24, 2026.

By elevating this issue, CISA signals to all organizations, public and private, that patching must receive urgent priority. Historical data shows that vulnerabilities added to the catalog often see accelerated attack volume in the days and weeks following public disclosure.

Affected Versions and Official Patches

The vulnerability impacts VMware Aria Operations 8.x releases. It also extends to related foundation products including VMware Cloud Foundation and VMware vSphere Foundation version 9.x.x.x when integrated with Aria Operations components.

Broadcom released fixes on February 24, 2026, as part of security advisory VMSA-2026-0001. The patched versions are:

• VMware Aria Operations 8.18.6
• VMware Cloud Foundation and vSphere Foundation 9.0.2.0

Administrators should verify their current deployment version and upgrade without delay through the official Broadcom support portal.

Immediate Workarounds for Time Sensitive Environments

For organizations unable to apply patches right away, Broadcom published a temporary mitigation script called aria-ops-rce-workaround.sh. Security teams must run this script as root on every Aria Operations virtual appliance node.

The script disables vulnerable migration service components by removing the associated shell script and eliminating a risky sudoers entry that previously allowed passwordless execution of workflow processes. While not a permanent solution, the workaround effectively blocks the known exploitation path until full patching can occur.

Potential Business and Security Impact

A successful remote code execution attack on an Aria Operations appliance carries severe consequences. Attackers could:

• Install persistent backdoors for long term access
• Steal detailed maps of the organizations entire IT estate
• Alter monitoring data to hide other malicious activity
• Disrupt critical alerting and capacity planning functions
• Use the compromised appliance as a pivot point to attack production workloads

Because Aria Operations often holds privileged access tokens and service accounts, the breach risk multiplies quickly. Enterprises in finance, healthcare, government, and critical infrastructure sectors face particularly high exposure.

Recommended Immediate Actions

Security and IT operations teams should take the following steps today:

1. Inventory all VMware Aria Operations deployments and confirm version numbers
2. Apply the latest security patches immediately where possible
3. Implement the official workaround script on any unpatched systems
4. Restrict network access to Aria Operations appliances to trusted internal addresses only
5. Monitor logs for suspicious migration service activity or unexpected command executions
6. Review and rotate any credentials stored or used by the platform
7. Notify executive leadership and incident response teams about the active threat

Proactive patching and network segmentation remain the most effective defenses against rapidly spreading vulnerabilities of this nature.

Broader Lessons for Enterprise Security

This incident underscores the persistent risk in complex enterprise management platforms. Even mature products with strong track records can contain subtle flaws in less frequently used workflows such as migration services. Organizations must maintain rigorous patch management discipline, especially for internet accessible or high value management systems.

The speed with which CISA added CVE-2026-22719 to its catalog also highlights improved threat intelligence sharing between vendors and government agencies. Enterprises that treat Known Exploited Vulnerabilities alerts as immediate executive priorities significantly reduce their likelihood of falling victim to commodity and targeted attacks alike.

As threat actors continue to automate exploitation of high profile flaws, timely remediation of CVE-2026-22719 stands as a critical priority for any organization operating VMware Aria Operations in 2026.