Loading story…
Broadcom issued advisory VMSA-2026-0001 for VMware Aria Operations (formerly vRealize Operations), warning of three vulnerabilities affecting Aria Operations and bundled platforms including VMware Cloud Foundation and VMware Telco Cloud. The most severe issue, CVE-2026-22719 (CVSS 8.1), is a command injection flaw that can be exploited by an unauthenticated attacker to execute arbitrary commands and potentially achieve remote code execution specifically while a support-assisted product migration is in progress. Broadcom released patches and also documented a workaround for CVE-2026-22719 in its response matrix/KB guidance.
The advisory also covers CVE-2026-22720 (CVSS 8.0), a stored XSS issue where a user with privileges to create custom benchmarks can inject script to perform administrative actions, and CVE-2026-22721 (CVSS 6.2), a privilege escalation path where a user with vCenter access to Aria Operations can elevate to administrative control. Researchers Sven Nobis and Lorin Lehawany of ERNW were credited with reporting at least part of the findings. Impacted deployments include Aria Operations 8.x and related bundles across Cloud Foundation and Telco Cloud product lines; Broadcom’s fixed versions include updates such as Aria Operations 8.18.6 and Cloud Foundation 9.0.2.0, and organizations are advised to prioritize upgrades due to the lack of workarounds for the XSS and privilege-escalation issues.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-25, a public vulnerability record for CVE-2026-22719 described the unauthenticated command injection flaw in VMware Aria Operations as leading to arbitrary command execution and possible remote code execution during support-assisted migration. The record pointed users to Broadcom's fixed-version matrix and workaround guidance.
On 2026-02-24, the Canadian Centre for Cyber Security published alert AV26-162 referencing VMSA-2026-0001 and warning that versions prior to Aria Operations 8.18.6 and Cloud Foundation/vSphere Foundation 9.0.2.0 were affected. It urged administrators to review the advisory and apply the necessary updates.
Broadcom released fixes for the disclosed flaws, including Aria Operations 8.18.6 and VMware Cloud Foundation and vSphere Foundation 9.0.2.0. The advisory noted only a limited workaround for CVE-2026-22719, increasing the need to apply updates for the remaining issues.
On 2026-02-24, Broadcom published security advisory VMSA-2026-0001 covering three vulnerabilities in VMware Aria Operations and related VMware Cloud Foundation and vSphere Foundation products. The issues were tracked as CVE-2026-22719, CVE-2026-22720, and CVE-2026-22721, including command injection, stored XSS, and privilege escalation impacts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecyber.gc.ca
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcesupport.broadcom.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Broadcom has released **VMSA-2026-0004** to fix three stored cross-site scripting vulnerabilities in VMware Cloud Foundation Operations, tracked as `CVE-2026-41722`, `CVE-2026-41723`, and `CVE-2026-41724`. The flaws affect VMware Cloud Foundation Operations and related enterprise cloud environments, including **VMware Aria Operations**, **VMware Telco Cloud Platform**, and **VMware vSphere Foundation** deployments. Broadcom rated the issues **Important**, with a maximum **CVSS v3.1 score of 8.0** and vector `AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`. According to the advisory, an authenticated user with privileges to create policies, views, or text widgets could inject malicious scripts that execute when viewed and potentially perform **administrative actions** inside the platform. Broadcom said the vulnerabilities were privately reported and published remediation guidance, including upgrading **Aria Operations to version 8.18.6**. Organizations running affected VMware management platforms have been urged to review exposed deployments and apply the available patches promptly.
Jun 29, 2026
VMware released security updates to fix multiple vulnerabilities across **VMware Aria Operations**, **VMware Cloud Foundation Operations**, **VMware Cloud Foundation**, **VMware vSphere Foundation**, and **VMware Telco Cloud Platform**. The most prominent issue, **`CVE-2026-41722`**, is a stored cross-site scripting flaw in VMware Cloud Foundation Operations with a **CVSS 8.0** rating that can be exploited over the network with low attack complexity, low privileges, and required user interaction. The update also remediates **`CVE-2026-41723`** and **`CVE-2026-41724`**, according to the advisory circulated by EG-FinCIRT and mirrored in multiple notices. Organizations using the affected VMware platforms were urged to test and deploy the patches promptly to reduce exposure across core virtualization and cloud management environments.
Jul 10, 2026
Broadcom issued **VMSA-2025-0010** to fix four vulnerabilities across VMware ESXi, vCenter Server, Workstation, Fusion, Cloud Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure, led by **CVE-2025-41225**, an authenticated command-execution flaw in **vCenter Server** with a **CVSS 8.8** score. According to the advisory, an attacker able to create or modify alarms and run script actions could exploit the bug, while additional fixes address **CVE-2025-41226** and **CVE-2025-41227** denial-of-service issues and **CVE-2025-41228**, a reflected **XSS** flaw affecting ESXi and vCenter Server. VMware said patches are available for all affected products and that **no workarounds** exist. The latest advisory follows earlier VMware warnings over serious **vCenter Server** weaknesses, including **VMSA-2024-0012**, which disclosed **CVE-2024-37079**, **CVE-2024-37080**, and **CVE-2024-37081** as memory-management and corruption flaws that could enable **remote code execution** in vCenter services. VMware said at the time it had no evidence of active exploitation, but urged customers to apply the listed patch versions because no official mitigations were provided; public GitHub material later appeared referencing **CVE-2024-37081**, underscoring continued security attention on vCenter exposure.
Jun 29, 2026