---
title: "Security Bulletin: Command Injection Leading to Remote Code Execution in VMware Aria Operations"
description: VMware Aria Operations vulnerability (CVE-2026-22719) enables command injection and RCE. CVSS 8.1. Actively exploited and listed in KEV. Patch immediately.
---

[Cybersecurity Blog | RedLegg ](https://www.redlegg.com/blog)

# [Security Bulletin: Command Injection Leading to Remote Code Execution in VMware Aria Operations](https://www.redlegg.com/blog/security-bulletin-command-injection-leading-to-remote-code-execution-in-vmware-aria-operations)

 Written by [RedLegg's Cyber Threat Intelligence Team](https://www.redlegg.com/blog/author/redleggs-cyber-threat-intelligence-team) | 3/3/26 10:17 PM

About:

CVE-2026-22719 is a high-severity command injection vulnerability in VMware Aria Operations. The flaw exists in support-assisted product migration functionality, where insufficient input validation allows a malicious actor to inject and execute arbitrary system commands. Confirmed exploitation activity has been observed, and the vulnerability is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Successful exploitation could result in remote code execution and compromise of monitoring and infrastructure management systems.

RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.

## VULNERABILITIES

## Authentication Bypass in Cisco Catalyst SD-WAN Controller and Manager

**CVSS Score:** **8.1 (High, CVSS v3.1)   
****Identifier: CVE-2026-22719 ****  
**PoC or Exploitation:   
There is confirmed exploitation of the vulnerability based on CISA KEV.

**Update/ Patch:   
** VMware has released fixes for CVE-2026-22719 as part of security advisory VMSA-2026-0001. Organizations should apply the security updates listed in the "Fixed Version" column of the VMware response matrix for their affected products.

Official VMware security advisory and patch guidance:   
[https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947)

**Description: **

CVE-2026-22719 is a command injection vulnerability in VMware Aria Operations. The flaw exists in support-assisted product migration functionality, where insufficient input validation allows a malicious actor to inject and execute arbitrary system commands.

 

**Mitigation Recommendation:   
**

Apply the VMware security updates referenced in advisory VMSA-2026-0001 immediately across all affected products and nodes.

 

Restrict access to VMware Aria Operations management interfaces and migration-related endpoints to trusted internal networks only.

 

 

[View full post](https://www.redlegg.com/blog/security-bulletin-command-injection-leading-to-remote-code-execution-in-vmware-aria-operations)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "RedLegg's Cyber Threat Intelligence Team"
  },
  "dateModified" : "2026-03-03T22:17:44.859Z",
  "datePublished" : "2026-03-03T22:17:44Z",
  "headline" : "Emergency Security Bulletin: Command Injection Leading to Remote Code Execution in VMware Aria Operations",
  "image" : {
    "@type" : "ImageObject",
    "height" : 630,
    "url" : "https://www.redlegg.com/hubfs/Emergency%20Bulletin%20v2.png",
    "width" : 1200
  },
  "mainEntityOfPage" : "https://www.redlegg.com/blog/security-bulletin-command-injection-leading-to-remote-code-execution-in-vmware-aria-operations",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/4675768/logo-red-01.png",
      "width" : 419.66666
    },
    "name" : "RedLegg Cybersecurity Blog"
  }
}
```