Skip to main content

Broadcom Releases Security Update to Address Vulnerabilities in VMware Aria Operations

Security advisory addresses three vulnerabilities that could result in command injection, cross site scripting, and privilege escalation

Threat ID:
CC-4749
Threat Severity:
Medium
Published:
4 March 2026 2:27 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security advisory addresses three vulnerabilities that could result in command injection, cross site scripting, and privilege escalation

Threat details

Exploitation of CVE-2026-22719 in the wild

Security researchers have reported exploitation of CVE-2026-22719 in the wild. The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-22719 to their Known Exploited Vulnerabilities (KEV) Catalog. The NHS England National CSOC assesses further exploitation as highly likely.

Introduction

Broadcom has released security updates to address vulnerabilities in VMware Aria Operations and Cloud Foundation components of VMware products.

The updates address 2 high severity and 1 medium severity vulnerabilities.

  • CVE-2026-22719 - "Command injection" vulnerability - CVSSv3 score of 8.1
  • CVE-2026-22720 - "Stored cross site scripting" vulnerability - CVSSv3 score of 8.0
  • CVE-2026-22721 - "Privilege escalation" vulnerability - CVSSv3 score of 6.2

Remediation advice

Affected organisations are encouraged to review Broadcom's VMSA-2026-0001.1 advisory and apply the relevant updates as soon as possible.

Last edited: 4 March 2026 2:27 pm