Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-22719
PUBLISHED
More InfoOfficial Page
Assigner-vmware
Assigner Org ID-dcf2e128-44bd-42ed-91e8-88f912c1401d
View Known Exploited Vulnerability (KEV) details
Published At-25 Feb, 2026 | 19:18
Updated At-26 Feb, 2026 | 15:50
Rejected At-
▼CVE Numbering Authority (CNA)
VMware Aria Operations command injection vulnerability

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.  To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001  Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001

Affected Products
Vendor
VMware (Broadcom Inc.)VMware
Product
Aria Operations
Package Name
vmware-aria-operations
Default Status
affected
Versions
Affected
  • From 8.18.0 before 8.18.6 (custom)
Unaffected
  • 8.18.6
Vendor
VMware (Broadcom Inc.)VMware
Product
Cloud Foundationcust
Package Name
vmware-cloud-foundation-operations
Default Status
affected
Versions
Affected
  • From 9.0 before 9.0.2 (custom)
  • From 4.0 before 5.2.3 (custom)
Unaffected
  • 9.0.2 (custom)
  • 5.2.3
Vendor
VMware (Broadcom Inc.)VMware
Product
Telco Cloud Platform
Package Name
vmware-telco-cloud-platform
Default Status
affected
Versions
Affected
  • From 2.0 before 5.2.3 (custom)
Unaffected
  • 5.2.3 (custom)
Vendor
VMware (Broadcom Inc.)VMware
Product
Telco Cloud Infrastructure
Package Name
vmware-telco-cloud-infrastructure
Default Status
affected
Versions
Affected
  • From 2.0 before 5.2.3 (custom)
Unaffected
  • 5.2.3
Metrics
VersionBase scoreBase severityVector
3.18.1HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Version: 3.1
Base score: 8.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Apply the vendor patches listed in the 'Fixed Version' column of the Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947  in VMSA-2026-0001. Fixed versions include VMware Aria Operations 8.18.6 (for 8.x) and VMware Cloud Foundation Operations 9.0.2.0 (for 9.x).

Configurations
Workarounds

Workarounds are available and documented by the vendor (see  VMSA-2026-0001  KB430349) https://knowledge.broadcom.com/external/article/430349 for environments where immediate patching is not possible.

Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947
vendor-advisory
https://knowledge.broadcom.com/external/article/430349
mitigation
https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html
release-notes
Hyperlink: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947
Resource:
vendor-advisory
Hyperlink: https://knowledge.broadcom.com/external/article/430349
Resource:
mitigation
Hyperlink: https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html
Resource:
release-notes
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Problem Types
TypeCWE IDDescription
CWECWE-77CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Type: CWE
CWE ID: CWE-77
Description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found