DaystoPatch

Broadcom (VMware)Exploited incident

VMware Aria Operations command injection (VMSA-2026-0001)

CVE-2026-22719High, CVSS 8.1In CISA's Known Exploited Vulnerabilities catalog since 3 Mar 2026

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Broadcom VMSA-2026-0001 (Wayback snapshot 2026-02-24)CuratedQuote verified

    Multiple vulnerabilities in VMware Aria Operations were privately reported to Broadcom. Patches and workarounds are available to remediate or workaround this vulnerability in affected Broadcom products.

    Coordinated disclosure: the advisory (Issue date 2026-02-24) was the first public signal and shipped with fixes and a workaround.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7bc13a290131fcf1…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    Bluesky postClaimedQuote not checked yet24 Feb 2026, 10:19 UTC

    in products like VMware Cloud Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure, faces command injection (CVE-2026-22719, CVSS 8.1), stored cross-site scripting (CVE-2026-22720, CVSS 8.0), and privilege escalation (CVE-2026-22721, CVSS 6.2) flaws.

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-22719ClaimedQuote verified25 Feb 2026, 19:18 UTC

    To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a485b5fbebb450ed…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-22719)ClaimedQuote verified3 Mar 2026

    Broadcom VMware Aria Operations Command Injection Vulnerability

    Added to CISA's KEV catalog on 2026-03-03.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Broadcom VMSA-2026-0001.1 change log (Wayback snapshot 2026-09-06)CuratedQuote verified3 Mar 2026

    Broadcom is aware of reports of potential exploitation of CVE-2026-22719 in the wild, but we cannot independently confirm their validity.

    Change log entry '2026-03-03: VMSA-2026-0001.1 Update for 3a'. First public statement about exploitation, after the fix; CISA listed the CVE in KEV the same day.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e64f14a9b386be34…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet6 Aug 2026, 19:58 UTC

    VMware Aria migration tool exploited for root RCE in wild. CISA KEV. Patch now. 9 detections, 2 IOCs. Full analysis + IOCs: https:// intel.threadlinqs.com/threat/T L-2026-1915 # ThreatIntel #

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Broadcom VMSA-2026-0001 (Wayback snapshot 2026-09-06)CuratedQuote verified

    2026-02-24: VMSA-2026-0001 Initial security advisory.

    The 2026-02-24 snapshot also shows 'Initial Publication Date 24 February 2026'. Broadcom's portal requires JavaScript, so snapshots are cited.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e64f14a9b386be34…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    date onlysame day

    Broadcom VMSA-2026-0001 (Wayback snapshot 2026-02-24)CuratedQuote verified

    Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the 'Response Matrix' below.

    Workaround: KB430349 (https://knowledge.broadcom.com/external/article/430349) for Aria Operations 8.18.x and 9.0.x.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7bc13a290131fcf1…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date onlysame day

    Broadcom VMSA-2026-0001 (Wayback snapshot 2026-02-24)CuratedQuote verified

    To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7bc13a290131fcf1…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Broadcom VMSA-2026-0001 (Wayback snapshot 2026-02-24)CuratedQuote verified

    Patches and workarounds are available to remediate or workaround this vulnerability in affected Broadcom products.

    The 2026-02-24 response matrix lists a fix for every product line: VCF Operations 9.x -> 9.0.2.0; Aria Operations 8.x -> 8.18.6; VCF (Aria Operations 5.x/4.x) -> KB92148 (shown as 8.18.6 in later snapshots); Telco Cloud Platform/Infrastructure -> KB428241.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7bc13a290131fcf1…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • VMware Aria Operations 8.x
  • VMware Cloud Foundation Operations 9.x
  • VMware Cloud Foundation (Aria Operations 4.x/5.x)
  • VMware Telco Cloud Platform
  • VMware Telco Cloud Infrastructure
How we built this timeline

Coordinated disclosure, exploited later. Exploitation requires that support-assisted product migration is in progress, per Broadcom's 'Known Attack Vectors'.

VMSA-2026-0001 also fixes CVE-2026-22720 and CVE-2026-22721 (not in KEV). Broadcom has not confirmed the exploitation reports ('cannot independently confirm their validity').

Broadcom's advisory pages give dates only, never times.

Related

Broadcom (VMware) report card