CVE-2026-22719

Published: Feb 25, 2026Modified: Jun 17, 2026CISA KEV

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: security@vmware.com (Secondary)

Description

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001

Affected (5)

Products: Vmware: Aria Operations, Cloud Foundation, Telco Cloud Infrastructure, Telco Cloud Platform

Vmware

4 products

Aria Operations

Cloud Foundation

Telco Cloud Infrastructure

Telco Cloud Platform

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Vmware Aria Operations	From 8.0 to 8.18.6
Vmware Cloud Foundation	From 4.0 to 5.2.3
Vmware Cloud Foundation	From 9.0 to 9.0.2.0
Vmware Telco Cloud Infrastructure	From 2.2 to 3.0
Vmware Telco Cloud Platform	From 4.0 to 5.1