Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-22721
PUBLISHED
More InfoOfficial Page
Assigner-vmware
Assigner Org ID-dcf2e128-44bd-42ed-91e8-88f912c1401d
View Known Exploited Vulnerability (KEV) details
Published At-25 Feb, 2026 | 20:00
Updated At-27 Feb, 2026 | 04:55
Rejected At-
▼CVE Numbering Authority (CNA)
VMware Aria Operations privilege escalation vulnerability

VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found in  VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 .

Affected Products
Vendor
VMware (Broadcom Inc.)VMware
Product
VMware Aria Operations
Package Name
vmware-aria-operations
Default Status
affected
Versions
Affected
  • From 8.18.0 before 8.18.6 (custom)
Unaffected
  • 8.18.6
Vendor
VMware (Broadcom Inc.)VMware
Product
VMware Cloud Foundation
Package Name
vmware-cloud-foundation-operations
Default Status
affected
Versions
Affected
  • From 4.0 before 5.2.3 (custom)
  • From 9.0 before 9.0.2 (custom)
Unaffected
  • 5.2.3
  • 9.0.2
Vendor
VMware (Broadcom Inc.)VMware
Product
VMware Telco Cloud Platform
Package Name
vmware-telco-cloud-platform
Default Status
affected
Versions
Affected
  • From 4.0 before 5.2.3 (custom)
Unaffected
  • 5.2.3 (custom)
Vendor
VMware (Broadcom Inc.)VMware
Product
VMware Telco Cloud Infrastructure
Package Name
vmware-telco-cloud-infrastructure
Default Status
affected
Versions
Affected
  • From 2.0 before 5.2.3 (custom)
Unaffected
  • 5.2.3 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-269CWE-269 Improper Privilege Management
Type: CWE
CWE ID: CWE-269
Description: CWE-269 Improper Privilege Management
Metrics
VersionBase scoreBase severityVector
3.16.2MEDIUM
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
Version: 3.1
Base score: 6.2
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

To remediate CVE-2026-22721, apply the vendor patches listed in the 'Fixed Version' column of the Response Matrix in  VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 . Fixed versions include VMware Aria Operations 8.18.6 (for 8.x) and VMware Cloud Foundation Operations 9.0.2.0 (for 9.x).

Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947
vendor-advisory
https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html
release-notes
Hyperlink: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947
Resource:
vendor-advisory
Hyperlink: https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html
Resource:
release-notes
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found