CVE-2026-22719

HighCVSS 8.1/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.

To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001

Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
VMware	VMware Aria Operations	>= 8.18.x, < 8.18.6
VMware	VMware Cloud Foundation Operations	>= 9.0, < 9.0.2; >= 4.0, < 5.2.3
VMware	Telco Cloud Platform	>= 2.0, < 5.2.3
VMware	Telco Cloud Infrastructure	>= 2.0, < 5.2.3

References

https://knowledge.broadcom.com/external/article/430349Mitigation, Vendor Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947Patch, Vendor Advisory
https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.htmlRelease Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22719US Government Resource

Timeline

Published: Feb 25, 2026
Last modified: Jun 17, 2026
Added to CISA KEV: Mar 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-22726.5A flaw was found in GIMP. An integer overflow vulnerability exists when processing ICO image files, specifically in the `ico_read_info` and CVE-2026-227209.0VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks m CVE-2026-227217.2VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations CVE-2026-227226.1A malicious actor with authenticated user privileges on a Windows based Workstation host may be able to cause a null pointer dereference err CVE-2026-227236.5Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78 CVE-2026-227265.0Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules. As a result, a mali CVE-2026-227277.5Unprotected internal endpoints in Cloud Foundry Capi Release 1.226.0 and below, and CF Deployment v54.9.0 and below on all platforms allows CVE-2026-227284.9Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotation handler derives t CVE-2026-227298.6A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based acce CVE-2026-22738.2CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of untrusted commands on th CVE-2026-227308.8A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access cont CVE-2026-227318.1Spring Boot applications with Actuator can be vulnerable to an "Authentication Bypass" vulnerability when an application endpoint that requi