CVE-2026-22719: VMware Aria Operations Command Injection -- Unauthenticated RCE via Migration

Background

VMware Aria Operations (formerly vRealize Operations) is Broadcom’s enterprise monitoring, analytics, and operations management platform for VMware virtualisation infrastructure. It provides capacity planning, performance monitoring, cost management, and automated remediation across vSphere, vSAN, NSX, and multi-cloud environments. Aria Operations is typically deployed in enterprise data centres and private cloud environments, often with privileged access to the entire virtualisation layer.

The strategic value of compromising Aria Operations is significant: the platform has read access to all VM performance data, infrastructure configuration, and in many deployments holds credentials for integrating with vCenter, cloud providers, and other management systems. Broadcom’s acquisition of VMware and subsequent product migrations created new migration-related functionality that introduced this vulnerability. CISA added CVE-2026-22719 to the KEV catalogue on 2026-03-03.

Technical Mechanism

CVE-2026-22719 is a command injection vulnerability that manifests in the support-assisted product migration workflow of VMware Aria Operations. Product migrations involve data transfer, configuration export/import, and service orchestration — all operations that commonly involve executing OS-level commands to manipulate files and services.

The vulnerability occurs when migration workflow parameters are accepted from HTTP requests and incorporated into shell commands without adequate sanitisation. The affected endpoint is accessible without authentication, making this a pre-auth RCE:

1. An attacker identifies an Aria Operations instance accessible over the network
2. The attacker sends a crafted HTTP request to the migration-related endpoint, including shell metacharacters in one or more parameters
3. The server-side code constructs a shell command string incorporating the unsanitised input
4. The injected commands execute under the Aria Operations service context, which typically runs as root or a highly privileged service account
5. The attacker achieves code execution capable of accessing all data stored in or accessible to Aria Operations, including vCenter credentials, cloud API keys, and monitoring data

The migration endpoint being unauthenticated is likely by design for the support workflow context (where an admin might need to initiate migration before full authentication is configured), but this design decision introduced a critical security boundary failure.

Real-World Exploitation Evidence

CVE-2026-22719 was added to CISA KEV on 2026-03-03. VMware management products have been consistently targeted by sophisticated threat actors:

• Nation-state actors — VMware infrastructure management tools have been targeted in campaigns attributed to Chinese, Russian, and North Korean threat actors seeking persistent access to corporate and government virtualisation environments
• Ransomware operators — VMware ESXi and associated management tools are high-value ransomware targets; encrypting VMs managed by vCenter/Aria Operations can cause organisation-wide outages
• The pattern of targeting product migration functionality is notable — these endpoints are often under-tested and may be enabled without IT teams being aware, as they may be enabled by support workflows rather than customer configuration

Organisations in financial services, healthcare, and government should treat this as critical priority given the typical deployment context of Aria Operations.

Impact Assessment

Successful exploitation of CVE-2026-22719 provides unauthenticated OS command execution under the Aria Operations service context, typically running as root or a high-privilege service account. From this position, an attacker can access all data held by Aria Operations, including vCenter credentials, cloud provider API keys (AWS, Azure, GCP), and SNMP community strings for infrastructure monitoring. These credentials effectively hand the attacker the keys to the entire virtualisation estate and any connected cloud environments, enabling them to operate as a legitimate infrastructure administrator.

The cascading impact is significant for enterprises built on VMware private cloud infrastructure. With vCenter credentials obtained from Aria Operations, an attacker can manipulate the entire VM estate: creating or deleting VMs, taking snapshots for data exfiltration, modifying network configurations, or deploying ransomware payloads directly to hypervisors. Organisations in financial services, healthcare, and government, where virtualisation underpins core application infrastructure, face potential organisation-wide service disruption from a single point of compromise in Aria Operations.

Affected Versions

Consult the Broadcom/VMware Security Advisory VMSA-2026-XXXX for precise affected version ranges.

Remediation Steps

1. Apply the Broadcom/VMware patch immediately
2. If patching is delayed, use firewall or network access control lists to restrict access to the Aria Operations management interface to trusted administrator IP addresses only
3. Disable or block the migration endpoint at the network layer if it is not actively needed:
   • Identify the specific migration-related URL path from the Broadcom advisory
   • Create a WAF rule or reverse proxy ACL to block access
4. Rotate all credentials stored in or accessible via Aria Operations:
   • vCenter service account credentials
   • Cloud provider API keys (AWS, Azure, GCP)
   • SNMP community strings and monitoring credentials
5. Review Aria Operations audit logs for unexpected access to migration endpoints
6. Audit the Aria Operations host OS for new accounts, cron jobs, or unusual processes
7. Review vCenter for any unexpected VM creation, snapshot activity, or permission changes

Detection Guidance

Aria Operations logs — review the application and access logs for:

• HTTP requests to migration-related API endpoints from unexpected source IP addresses
• Requests containing shell metacharacters in URL parameters (;, &, |, `)
• Unusual activity on the migration endpoint outside support windows

OS-level monitoring:

• New processes spawned by the Aria Operations service process
• File creation in /tmp or other world-writable directories
• Unexpected outbound network connections from the Aria Operations host

vCenter audit trail:

• Unexpected logins to vCenter using credentials stored in Aria Operations
• Configuration changes to VM permissions, network policies, or storage
• Snapshot creation on large numbers of VMs (potential ransomware staging)

SIEM query example (Splunk):

index=vmware_logs sourcetype=aria_ops_access
| search uri_path="*/migration*" OR uri_path="*/support-migration*"
| eval suspicious=if(match(uri_query, "[;&|`$]"), "YES", "NO")
| where suspicious="YES" OR match(src_ip, "^(?!10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.).*")
| stats count by src_ip, uri_path, uri_query

Timeline

References

• NVD — CVE-2026-22719
• CISA KEV — CVE-2026-22719
• Broadcom Security Advisory — CVE-2026-22719