CVE-2026-22719: Broadcom VMware Aria Operations Command Injection Vulnerability

Added to the CISA Known Exploited Vulnerabilities catalog on 03 Mar 2026. Vendor: Broadcom. Product: VMware Aria Operations.

Broadcom VMware Aria Operations formerly known as vRealize Operations (vROps) contains a command injection vulnerability that allows an unauthenticated attacker to execute arbitrary commands, potentially leading to remote code execution during support‑assisted product migration.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due 24 Mar 2026)