A recently patched vulnerability in VMware Aria Operations (formerly vRealize Operations) has been exploited in the wild, the cybersecurity agency CISA warned on Tuesday.
The vulnerability, tracked as CVE-2026-22719, is a high-severity command injection issue that can be exploited without authentication.
“A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress,” Broadcom explained in a February 24 advisory announcing patches for the flaw.
CISA added CVE-2026-22719 to its Known Exploited Vulnerabilities (KEV) catalog on Tuesday, instructing federal agencies to address it by March 24.
There appears to be no public information describing attacks involving the vulnerability.
In an update to its initial advisory, Broadcom noted, “Broadcom is aware of reports of potential exploitation of CVE-2026-22719 in the wild, but we cannot independently confirm their validity”.
It’s unclear whether Broadcom learned about the in-the-wild exploitation from CISA or a different source.
It’s also unclear whether exploitation of the vulnerability started after a patch was released or CVE-2026-22719 was exploited as a zero-day.
Nevertheless, it’s encouraging to see Broadcom promptly update its security advisory when potential exploitation of a vulnerability is detected. In contrast, the company has previously faced criticism for delaying such warnings even when exploitation was known for extended periods.
Related: Scattered Spider Targeting VMware vSphere Environments
Related: 2024 VMware Flaw Now in Attackers’ Crosshairs
Related: Exploit for VMware Zero-Day Flaws Likely Built a Year Before Public Disclosure
