← Back

CVE-2026-22721

nvd nist
Published: Feb 25, 2026Modified: Jun 17, 2026

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: NVD

Description

VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found in  VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 .

Affected (5)

Vmware
4 products
Aria Operations
Cloud Foundation
Telco Cloud Infrastructure
Telco Cloud Platform
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Aria Operations
From 8.0 to 8.18.6
Vmware
Cloud Foundation
From 4.0 to 5.2.3
Cloud Foundation
From 9.0 to 9.0.2.0
Telco Cloud Infrastructure
From 2.2 to 3.0
Telco Cloud Platform
From 4.0 to 5.1

Related CWEs

CWE-269
Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (2)

Source: security@vmware.com
PatchVendor Advisory
Source: security@vmware.com
Release Notes

Timeline

No history available yet.