CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 to KEV Catalog - The Hacker News

CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 to KEV Catalog Ravie LakshmananMar 04, 2026Vulnerability / Enterprise Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a recently disclosed security flaw impacting Broadcom VMware Aria Operations to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. The high-severity vulnerability, CVE-2026-22719 (CVSS score: 8.1), has been described as a case of command injection that could allow an unauthenticated attacker to execute arbitrary commands. "A malicious unauthenticated actor may exploit this issue to execute arbitrary commands, which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress," the company said in an advisory released late last month. The shortcoming was addressed, along withCVE-2026-22720, a stored cross-site scripting vulnerability, and CVE-2026-22721, a privilege escalation vulnerability that could result in administrative access. It impacts the following products - VMware Cloud Foundation and VMware vSphere Foundation 9.x.x.x - Fixed in 9.0.2.0 VMware Aria Operations 8.x - Fixed in 8.18.6 Customers who cannot apply the patch immediately can download and run a shell script ("aria-ops-rce-workaround.sh") as root from each Aria Operations Virtual Appliance node. There are currently no details on how the vulnerability is being exploited in the wild, who is behind it, and the scale of such efforts. "Broadcom is aware of reports of potential exploitation of CVE-2026-22719 in the wild, but we cannot independently confirm their validity," the company noted in an update to its bulletin. In light of active exploitation, Federal Civilian Executive Branch (FCEB) agencies are required to apply the fixes by March 24, 2026. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  Broadcom, CISA, Cloud security, Command Injection, cybersecurity, enterprise security, remote code execution, software security, vmware, Vulnerability ⚡ Top Stories This Week New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption ⚡ Weekly Recap: Linux Rootkit, macOS Crypto Stealer, WebSocket Skimmers and More Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI and More Packages Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak Four OpenClaw Flaws Enable Data Theft, Privilege Escalation, and Persistence Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation [Webinar] How Modern Attack Paths Cross Code, Pipelines, and Cloud ThreatsDay Bulletin: PAN-OS RCE, Mythos cURL Bug, AI Tokenizer Attacks, and 10+ Stories On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday 18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager Backdoor Load More ▼ ⭐ Featured Resources Identify Internal Attack Surfaces More Efficiently With a Free Assessment [Webinar] Learn How to Handle Critical SOC Alerts With AI Support [eBook] Get the 3-Number SOC Diagnostic to Reduce Queue Risk [Guide] Stop Email Fraud Before It Turns Into Ransomware Damage