CISA Adds VMware Aria Operations Flaw to Exploited Vulnerabilities Catalog
CISA adds CVE-2026-22719, a command injection flaw in Broadcom VMware Aria Operations rated CVSS 8.1, to the Known Exploited Vulnerabilities catalog — giving federal agencies until March 24 to patch after confirming active exploitation during product migration operations.
CISA has added CVE-2026-22719 to the Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation of a command injection flaw in Broadcom VMware Aria Operations that allows unauthenticated remote code execution during product migration operations. Federal agencies have until March 24 to apply the patch.
Vulnerability Details
CVE-2026-22719 carries a CVSS score of 8.1 and affects VMware Aria Operations (formerly vRealize Operations), a monitoring and analytics platform used by enterprises to manage VMware-based virtualization environments. The vulnerability exists in the product's migration functionality — an attacker who can reach the migration endpoint can inject arbitrary commands that execute with the privileges of the Aria Operations service account, without requiring authentication.
Related Vulnerabilities
The original patch, released by Broadcom on February 24, also addressed CVE-2026-22720 (a cross-site scripting vulnerability) and CVE-2026-22721 (a privilege escalation flaw). While only CVE-2026-22719 has been confirmed as actively exploited, CISA recommends patching all three vulnerabilities simultaneously, as the XSS and privilege escalation flaws could be chained with other vulnerabilities to achieve more impactful attacks.
Enterprise Impact
VMware Aria Operations is widely deployed in enterprise data centers, particularly in organizations with large VMware vSphere environments. The vulnerability is most dangerous during migration operations — precisely the scenario where organizations are most likely to have temporary network configurations that expose management interfaces more broadly than normal operations. Organizations planning VMware migrations should ensure the Aria Operations patch is applied before beginning migration activities, and should restrict network access to Aria management interfaces regardless of patch status.
Related Articles
Cloudflare 2026 Threat Report: 230 Billion Daily Blocked Threats and the Rise of Credential Attacks
Cloudflare has published its inaugural annual threat report revealing the company blocks over 230 billion threats daily across 20% of global web traffic. DDoS attacks doubled year-over-year to 47.1 million incidents, with the largest reaching a record 31.4 Tbps, while bots now account for 94% of all login attempts.
HashiCorp Patches Consul Arbitrary File Read Vulnerability in Kubernetes Auth
HashiCorp has released emergency patches for Consul to address CVE-2026-2808, a medium-severity vulnerability allowing arbitrary file reads when Kubernetes authentication is enabled. The fix also adds HTTP server timeouts to prevent Slowloris denial-of-service attacks against Consul agent endpoints.
Let's Encrypt Now Issues Six-Day Certificates and IP Address Certificates via Certbot
Let's Encrypt and the EFF have announced support for six-day (160-hour) certificates and IP address certificates through Certbot 5.3 and 5.4. The ultra-short-lived certificates reduce the impact window of compromised keys by design, while IP address certificates enable HTTPS for services identified by address rather than hostname.