CVE-2026-22719
Command Injection in Broadcom VMware Aria Operations. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 3 March 2026.
- Product
- Broadcom VMware Aria Operations
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- No known use in ransomware campaigns
- Vendor advisories
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.
More from Broadcom this year.
- CVE-2026-41709 Insufficient Logging, added
- CVE-2026-59310 Path Traversal, added
- CVE-2024-37079 Out-of-bounds Write, added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.