CVE-2026-22719

This vulnerability is a “command injection” issue, meaning an attacker can smuggle instructions into VMware Aria Operations in a way that makes it run commands on the underlying server. If someone finds your system during an active support-assisted migration, they can potentially take over the server with high privileges. Think of it like a maintenance help process that accidentally opens a back door to anyone who sends the right input.

This matters if you use VMware Aria Operations (or VMware Cloud Foundation/Telco Cloud components that include or rely on it) and you perform support-assisted product migration—because the attack scenario requires that migration process to be in progress. It does not require an attacker account or you to click anything; it’s network-based. The practical risk is tied to reachability during that migration window—if attackers can reach the exposed VMware Aria Operations service and the migration/support-assisted process is active, your exposure is much higher.

This is RED because it’s in CISA KEV, meaning it has been seen used in the real world and you are expected to mitigate it. The weakness can let an unauthenticated attacker run commands as a high-privileged user during support-assisted migration, so the window for risk is narrow but very dangerous.

1. Identify exposure

   • Confirm whether you run VMware Aria Operations and any listed related deployments (Cloud Foundation Operations and Telco Cloud Platform/Infrastructure).
   • Determine your exact deployed version.
   • Determine whether a support-assisted product migration is currently in progress or scheduled soon.

2. Decide your fixed target (per vendor “Fixed Version”)

   • VMware Aria Operations: upgrade to 8.18.6.
   • VMware Cloud Foundation Operations: upgrade to 9.0.2 for the applicable branch, or 5.2.3 for the applicable branch.
   • Telco Cloud Platform: upgrade to 5.2.3.
   • Telco Cloud Infrastructure: upgrade to 5.2.3.

3. Patch planning and verification

   • Schedule the upgrade as soon as possible, especially if migration is happening.
   • After upgrading, verify the Aria Operations services are running normally and the migration tasks complete successfully.

4. If patching is not immediately possible

   • Use the vendor-documented workaround in VMSA-2026-0001 / KB430349.
   • Apply any exposure reduction guidance the vendor provides in that advisory (for example, limiting network access to the Aria Operations management endpoints during the migration window).

5. What to monitor

   • Look for unexpected high-privilege command execution, unusual process creation, and any signs of system changes during or around the migration period.
   • Review logs around the time of the support-assisted migration for suspicious requests to the Aria Operations interfaces.

6. Compliance timeline

   • CISA remediation due date for KEV: 2026-03-24.

Severity and status: This is a high-impact command injection (CWE-77) with a high CVSS score (8.1) and confirmed presence in CISA KEV (added 2026-03-03). Although public exploit code was not found in the provided materials, the KEV listing indicates real-world targeting.

Mechanism: A network-reachable, unauthenticated input flaw allows attackers to inject commands so the service can execute arbitrary system commands. The findings specifically tie successful exploitation to when support-assisted product migration is in progress.

Attack vector and prerequisites: Network-based; no authentication required; no user interaction required for the technical exploit. Practical prerequisite is an active support-assisted migration workflow.

EPSS: A predicted likelihood score is reported as rising, but for urgency decisions the KEV status is the controlling factor and outweighs prediction.

Workarounds/fix: Vendor remediation is described in VMSA-2026-0001, with fixed versions including VMware Aria Operations 8.18.6 and branch-specific updates for VMware Cloud Foundation Operations and Telco Cloud Platform/Infrastructure (5.2.3 and/or 9.0.2). A documented workaround exists in KB430349 for delayed patching scenarios.