Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-22719

CVE-2026-22719HIGH

VMware Aria Operations command injection vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   N  U  H  H  H    8.1   .1771   97.1   YES

AFFECTED
  Product                             Versions  Fixed
  VMware Aria Operations              8.18.x –  —
  VMware Cloud Foundation Operations  9.0 –     9.0.2
  Telco Cloud Platform                2.0 –     5.2.3
  Telco Cloud Infrastructure          2.0 –     5.2.3

TIMELINE
  Jan 9   Reserved by vmware
  Feb 25  Published (CNA: vmware)
  Mar 3   Added to CISA KEV, remediation due 2026-03-24

CWE-77 · CNA: vmware · CVSS v3.1 · 4 references · KEV due March 24, 2026

Description

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 9, 2026	Reserved	Reserved by vmware
February 25, 2026	Published	Published (CNA: vmware)
March 3, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-03-24

Affected

Affected products and packages — 4 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
VMware	VMware Aria Operations	—	8.18.x	—
VMware	VMware Cloud Foundation Operations	—	9.0	9.0.2
VMware	Telco Cloud Platform	—	2.0	5.2.3
VMware	Telco Cloud Infrastructure	—	2.0	5.2.3

Weaknesses

CWE-77

References (4)

https://knowledge.broadcom.com/external/article/430349 [mitigation]
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 [vendor-advisory]
https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html [release-notes]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22719 [government-resource]

Authoritative record: CVE-2026-22719 at cve.org

Vendors: vmware

Weaknesses: CWE-77

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-22719 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.