CVE-2026-22719: Broadcom VMware Aria Operations Command Injection Vulnerability

Broadcom VMware Aria Operations, formerly known as vRealize Operations, contains a command injection vulnerability that permits an unauthenticated attacker to execute arbitrary commands. The flaw can result in remote code execution when the product is used during support-assisted migration. Organizations running this operations-management platform should treat the issue as a priority because unauthenticated remote code execution paths can lead to full host compromise without prior credentials.

How it works

The weakness is classified as CWE-77, command injection. An attacker supplies crafted input that the application passes to an underlying operating-system command interpreter. Because the input is not properly sanitized or parameterized, the interpreter executes the attacker-supplied portion as additional commands. The CISA summary notes that the injection opportunity arises specifically during support-assisted product migration; the precise entry point and required conditions must be confirmed against the vendor advisory.

Am I affected? How to find it in your systems

Broadcom VMware Aria Operations is typically deployed as a virtual appliance or clustered management node that monitors VMware and multi-cloud environments. Inventory all instances by querying your virtualization platform for appliances whose name or description contains “Aria Operations,” “vRealize Operations,” or “vROps.” Record the exact build numbers and compare them with the versions listed in the vendor advisory. Review configuration files and migration logs for any enabled support-assisted migration features. Because the attack is unauthenticated, network telemetry showing unexpected connections to migration-related ports or anomalous process spawns on the appliance may indicate attempted exploitation; retain those logs for forensic review.

How to remediate

Apply the vendor-supplied update referenced in the official advisory as the primary remediation. After patching, disable or restrict the support-assisted migration feature if it is not required in your environment. Review all external interfaces that accept migration-related parameters and ensure they enforce strict input validation or are placed behind authenticated management networks. Re-audit service accounts and API tokens that were previously granted elevated privileges for migration tasks.

If you can't patch immediately

Follow the CISA directive to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Segment the management cluster so that only authorized jump hosts can reach migration ports. Where a web application firewall or virtual patching capability is present, create rules that block or sanitize the parameter patterns associated with the affected migration workflow. Increase logging verbosity on the appliance and forward events to a central SIEM for detection of command-execution indicators. For cloud-hosted deployments, adhere to any applicable BOD 22-01 requirements.

If your data may have been exposed

Actively exploited vulnerabilities of this class have led to breaches in other products. Run a free exposure scan of your organization’s email domains against known breach data to determine whether credentials or internal system information have already appeared in public repositories.