A high-severity command injection vulnerability in VMware Aria Operations is now being actively exploited, according to the Cybersecurity and Infrastructure Security Agency.
The flaw, CVE-2026-22719 (CVSS 8.1), allows a malicious unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution.
Why this is serious
Aria Operations is a central cloud infrastructure management platform.
If compromised, attackers could gain visibility into and control over:
• vCenter credentials and service accounts
• Network topology and monitoring systems
• ESXi hosts across the environment
• SOC monitoring visibility
In short: compromising Aria Operations could expose the entire virtual infrastructure.
Affected versions
• Aria Operations 8 – 8.18.5
• Aria Operations 9 – 9.0.1
The issue was fixed in 8.18.6 and later, and a mitigation script is also available.
Recommended actions
• Patch immediately to the fixed version
• Apply the Broadcom workaround script if patching is delayed
• Monitor infrastructure management platforms for suspicious activity
• Review credentials and privileged access across vSphere environments
Management platforms remain high-value targets for attackers, as compromising them can provide control over entire environments.
