Broadcom released security advisory VMSA-2026-0001 on February 24, 2026, addressing three critical vulnerabilities in VMware Aria Operations that could enable remote code execution, cross-site scripting, and privilege escalation.
These flaws affect key products like VMware Cloud Foundation and Telco Cloud platforms, urging organizations to apply patches immediately. The issues carry CVSS scores ranging from 6.2 to 8.1, classified as Important severity.
Vulnerability Details
The most severe flaw, CVE-2026-22719, is a command injection vulnerability in VMware Aria Operations with a CVSSv3 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Malicious unauthenticated attackers can exploit it during support-assisted product migrations to execute arbitrary commands, leading to full remote code execution. A workaround exists via KB430349, but upgrading to fixed versions is recommended.
CVE-2026-22720 involves stored cross-site scripting (XSS) with a CVSS score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), allowing privileged users to create custom benchmarks to inject scripts for administrative actions.
No workaround is available; patches are essential. CVE-2026-22721 is a privilege escalation issue (CVSS 6.2: AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L) where vCenter-privileged actors can gain admin access in Aria Operations, also requiring patching without workarounds.
These vulnerabilities impact VMware Aria Operations 8.x, VMware Cloud Foundation 9.x/5.x/4.x, VMware Telco Cloud Platform 5.x/4.x, and VMware Telco Cloud Infrastructure 3.x/2.x running on any platform.
Organizations must upgrade to resolved versions like Aria Operations 8.18.6, Cloud Foundation Operations 9.0.2.0, or apply specific KBs such as 92148, 428241.
| CVE ID | CVSS Score | Description | Severity | Fixed Version |
|---|---|---|---|---|
| CVE-2026-22719 | 8.1 | Command injection leading to RCE during migrations | Important | 8.18.6 (Aria Ops), 9.0.2.0 (VCF) |
| CVE-2026-22720 | 8.0 | Stored XSS via custom benchmarks | Important | 8.18.6 (Aria Ops), 9.0.2.0 (VCF) |
| CVE-2026-22721 | 6.2 | Privilege escalation from vCenter access | Moderate | 8.18.6 (Aria Ops), 9.0.2.0 (VCF) |
Broadcom credits Tobias Anders from Deutsche Telekom Security for CVE-2026-22720, and Sven Nobis and Lorin Lehawany from ERNW for CVE-2026-22721; CVE-2026-22719 was privately reported.
| Product | Component | Affected Versions | Fixed Version | Workaround |
|---|---|---|---|---|
| VMware Cloud Foundation | VMware vSphere Foundation / Operations | 9.x | 9.0.2.0 [techdocs.broadcom.com] | KB430349 (CVE-2026-22719) |
| VMware Aria Operations | N/A | 8.x | 8.18.6 [techdocs.broadcom.com] | KB430349 (CVE-2026-22719) |
| VMware Cloud Foundation | VMware Aria Operations | 5.x, 4.x | KB92148 | KB430349 (CVE-2026-22719) |
| VMware Telco Cloud Platform | VMware Aria Operations | 5.x, 4.x | KB428241 | KB430349 (CVE-2026-22719) |
| VMware Telco Cloud Infrastructure | VMware Aria Operations | 3.x, 2.x | KB428241 | KB430349 (CVE-2026-22719) |
Administrators should review the full advisory, download patches from Broadcom support portals, and monitor environments during migrations. Prioritizing these updates prevents potential breaches in enterprise cloud operations.
Follow us on Google News, LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
%20(1).webp?fit=1600,900&ssl=1&description=These flaws affect key products like VMware Cloud Foundation and Telco Cloud platforms, urging organizations to apply patches immediately.){kind=link}