VMware Aria Operations Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-22719)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2026-22719) is a critical Command Injection (CWE-77) flaw within VMware Aria Operations. The root cause lies in the insufficient input validation and sanitization of user-supplied parameters during the support-assisted product migration process. When this migration feature is active, the application fails to properly escape shell metacharacters, allowing injected commands to be executed directly by the underlying operating system.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker can exploit this vulnerability by targeting an active migration session. By sending crafted network requests containing shell metacharacters (such as ';', '&&', or backticks) to the migration endpoint, the attacker forces the application to concatenate and execute these malicious payloads. Since no authentication is required for this specific vector during the migration window, the attacker can easily establish a reverse shell or download secondary payloads.

3. Infrastructure & Business Impact

With a CVSS score of 8.1 and its inclusion in the CISA KEV catalog, this vulnerability poses an immediate threat to enterprise environments. Successful exploitation grants the attacker administrative privileges on the Aria Operations appliance, enabling them to compromise virtualized infrastructure monitoring data, disrupt operations, or pivot deeper into the internal corporate network.