Broadcom patched multiple VMware Aria Operations flaws, including high-severity issues that could enable remote code execution.
Broadcom has released security updates to address multiple vulnerabilities affecting VMware Aria Operations.
VMware Aria Operations is an IT operations management platform that helps organizations monitor and optimize virtual, cloud, and hybrid environments. It provides performance monitoring, capacity planning, automated alerting, and cost analysis, giving IT teams greater visibility and control over infrastructure to ensure efficiency, reliability, and compliance.
The most severe of the flaws is a command injection vulnerability, tracked as CVE-2026-22719 (CVSS 8.1), which an unauthenticated attacker can exploit remotely.
“A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.” reads the advisory.
This vulnerability was privately reported to Broadcom.
The company also addressed a high-severity stored cross-site scripting (XSS) flaw in Aria Operations. The vulnerability, tracked as CVE-2026-22720 (CVSS score of 8.0), is a stored cross-site scripting (XSS).
A threat actor with privileges to create custom benchmarks can exploit the flaw to inject script to perform administrative actions in VMware Aria Operations.
The third vulnerability addressed by Broadcom is a medium-severity privilege escalation issue, tracked as CVE-2026-22721 (CVSS score of 6.2) that can be exploited to obtain administrative access.
VMware Cloud Foundation (v9.0.2.0), VMware vSphere Foundation (v9.0.2.0), and Aria Operations (v8.18.6) address the above issues. Customers are strongly urged to apply these updates promptly to protect systems, minimize the risk of compromise, and reduce exposure to potential attacks.
The company did not say if any of these flaws was exploited in attacks in the wild.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Broadcom)
