CVE-2026-22719

What it actually does

CVE-2026-22719 is a network-reachable command injection vulnerability in VMware Aria Operations that can allow an unauthenticated attacker to execute arbitrary operating-system commands on the affected appliance. Exploitation requires the support-assisted product migration workflow to be in progress, which raises the attack complexity, but no credentials or user interaction are required. Successful exploitation can result in remote code execution with the privileges of the vulnerable service, potentially enabling full compromise of the Aria Operations appliance, access to monitored infrastructure data, modification of application state, and disruption of availability. The issue also affects environments consuming Aria Operations through VMware Cloud Foundation, VMware Telco Cloud Infrastructure, and VMware Telco Cloud Platform where the vulnerable component/version is present.

Why it matters to the business

A successful attack can give an external attacker control over a VMware Aria Operations system during a migration window, creating risk to infrastructure monitoring, operational visibility, credentials or secrets stored on the appliance, and connected VMware management environments. Because this vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and the federal remediation deadline of 2026-03-24 has already passed, organizations should treat unpatched exposed systems as high-priority incident-response candidates rather than routine patching work. Although it is not currently flagged as ransomware-associated, compromise of a management and monitoring platform can support lateral movement, persistence, data theft, and operational disruption.

How an attack unfolds

An attacker first identifies an internet-accessible or otherwise reachable VMware Aria Operations instance and determines whether it is in or near a support-assisted product migration state. During that migration workflow, vulnerable request handling can pass attacker-controlled input into an operating-system command context without sufficient sanitization. The attacker submits a crafted network request containing shell metacharacters or command payloads to the vulnerable migration-related functionality. If the vulnerable code path is active, the appliance executes the injected command. The attacker may then run reconnaissance commands, download tooling, establish a reverse shell or web-accessible backdoor, collect configuration and credential material, and use the compromised appliance as a foothold into adjacent VMware management or infrastructure networks. Reported active exploitation and KEV inclusion indicate defenders should assume public exploit knowledge exists even if exploitation depends on the migration condition.

How to fix it

Apply the vendor-provided patches listed in the Fixed Version column of Broadcom VMware Security Advisory VMSA-2026-0001 / response matrix for the exact affected product and deployment type. Because no universal fixed version was provided in the input, administrators should verify the appliance edition and version against the Broadcom response matrix for VMware Aria Operations, VMware Cloud Foundation, VMware Telco Cloud Infrastructure, and VMware Telco Cloud Platform. If immediate patching is not possible, apply the vendor-documented workaround from the Workarounds column of VMSA-2026-0001, especially for any environment where support-assisted product migration is active or planned. Restrict access to Aria Operations management and migration interfaces to trusted administrative networks only, block direct internet exposure, and place the appliance behind access controls such as VPN, firewall allowlists, or zero-trust application access. Avoid starting or continuing support-assisted migrations on unpatched systems unless the vendor workaround is in place and network exposure is tightly controlled. After patching or mitigating, rotate credentials, API tokens, certificates, and integration secrets that may have been accessible from the appliance if exploitation is suspected.

How to confirm the fix worked

Confirm the installed VMware Aria Operations build and any bundled versions in VMware Cloud Foundation, VMware Telco Cloud Infrastructure, or VMware Telco Cloud Platform match the fixed entries in the Broadcom VMSA-2026-0001 response matrix. Verify that vendor workarounds, if used, are still present and documented, and confirm whether they remain necessary after patching. Validate that support-assisted migration functionality is not exposed to untrusted networks and that only trusted administrative sources can reach management interfaces. Review firewall, load balancer, reverse proxy, and access-control rules for Aria Operations. Perform authenticated version checks through the product UI or appliance management interface where possible, and cross-check with package/build inventory. If a scanner is used, ensure it verifies the patched build rather than only banner information. Confirm no migration-related services or endpoints are reachable from the internet unless explicitly required and protected. For previously exposed systems, complete compromise assessment before declaring remediation complete.

Typical attack path

1. Discover VMware Aria Operations, VMware Cloud Foundation, VMware Telco Cloud Infrastructure, or VMware Telco Cloud Platform deployments containing the vulnerable Aria Operations component.
2. Identify systems exposed to untrusted networks or reachable from compromised internal hosts.
3. Probe for evidence that support-assisted product migration is in progress or that migration-related services/endpoints are reachable.
4. Send a crafted unauthenticated request that injects operating-system command syntax into the vulnerable migration workflow.
5. Execute initial commands to confirm code execution and determine user privileges, hostname, network configuration, and available tools.
6. Retrieve or stage additional payloads using built-in utilities such as curl, wget, bash, sh, Python, or Perl where available.
7. Establish persistence or remote access, commonly through a reverse shell, scheduled task, modified service, dropped script, or unauthorized account/key material.
8. Collect VMware Aria Operations configuration, logs, credentials, tokens, certificates, or integration secrets.
9. Use the compromised appliance to access connected VMware management systems, monitored infrastructure, or internal services.
10. Clear or tamper with logs and continue lateral movement, data collection, or service disruption.

How to detect it

Investigate whether the appliance was exposed during any support-assisted migration window before patching or workaround deployment. Collect VMware Aria Operations application logs, appliance system logs, web access logs, reverse proxy or load balancer logs, firewall logs, EDR telemetry, shell history, process execution records, cron/systemd artifacts, and authentication logs. Look for unauthenticated requests to migration-related functionality followed by operating-system command execution, outbound network connections, file downloads, or newly written executable scripts. Pay particular attention to request parameters containing shell metacharacters such as semicolons, pipes, backticks, command substitution, URL-encoded command separators, or references to common download and shell utilities. On the appliance, hunt for unexpected child processes spawned by application or web service accounts, including sh, bash, curl, wget, nc, ncat, python, perl, openssl, busybox, or base64. Review /tmp, /var/tmp, application working directories, web-accessible directories, cron locations, systemd unit paths, SSH authorized_keys files, and recently modified scripts for unauthorized payloads. Correlate timestamps of suspicious requests with process execution, DNS lookups, outbound connections, authentication anomalies, and changes to VMware integrations or credentials. Because this issue is actively exploited and KEV-listed, absence of a known public IOC should not be treated as proof of no compromise; use behavioral evidence and timeline analysis.

• /tmp/
• /var/tmp/
• /dev/shm/
• /etc/cron.d/
• /etc/crontab
• /var/spool/cron/
• /root/.ssh/authorized_keys
• /.ssh/authorized_keys
• /etc/systemd/system/
• /lib/systemd/system/
• /bin/sh -c
• /bin/bash -c
• bash -i
• sh -i
• curl http
• curl -k
• wget http
• wget --no-check-certificate
• nc -e
• ncat -e
• mkfifo /tmp/
• python -c
• python3 -c
• perl -e
• base64 -d
• chmod +x /tmp/
• chmod +x /var/tmp/
• crontab -e
• systemctl enable
• systemctl start
• nohup
• setsid
• /bin/busybox
• `id`
• $(id)
• ;id
• |id
• %3Bid
• %7Cid
• %24%28id%29

What your security team should do

• Immediately inventory all VMware Aria Operations deployments, including those embedded in VMware Cloud Foundation, VMware Telco Cloud Infrastructure, and VMware Telco Cloud Platform.
• Prioritize patching or vendor workaround application for any deployment that is internet-accessible, reachable by large internal network segments, or undergoing support-assisted product migration.
• Treat unpatched systems as urgent because the vulnerability is in CISA KEV, is reported as actively exploited in the wild, and the KEV due date has passed.
• Temporarily restrict Aria Operations management and migration-related access to dedicated administrative networks or VPN-only access until patching is complete.
• Suspend nonessential support-assisted migration activity on unpatched appliances, or perform it only under tightly controlled network conditions with vendor mitigation applied.
• Run a retrospective hunt across appliance, proxy, firewall, EDR, and authentication logs for suspicious unauthenticated requests and command-execution artifacts around migration windows.
• If suspicious activity is found, isolate the appliance, preserve forensic evidence, rotate credentials and tokens accessible to the appliance, and investigate connected VMware management systems for lateral movement.
• Add monitoring for child process execution from Aria Operations services, especially shells, download utilities, scripting interpreters, and outbound connections to unusual destinations.
• Review vendor advisories for updates to fixed versions, workarounds, and exploitation details, as active exploitation may evolve.
• Document compensating controls and patch status for compliance teams because KEV-listed vulnerabilities often carry explicit remediation obligations.