Critical VMware Aria Operations Vulnerability Exploited in the Wild, Added to CISA KEV Catalog A severe command injection vulnerability in VMware Aria Operations an IT operations management platform for data centers and cloud environments has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation emerged. The flaw, tracked as CVE-2026-22719, allows unauthenticated attackers to execute arbitrary commands on affected systems, leading to remote code execution (RCE). Exploitation occurs during support-assisted product migrations, posing a high risk to organizations using the platform. Successful attacks could grant threat actors unauthorized system access, command execution, and potential full infrastructure compromise. Broadcom, VMware’s parent company, released a security advisory detailing the issue, which stems from a CWE-77 (Command Injection) weakness. While the CVSS score remains unassigned, CISA’s inclusion of the vulnerability in the KEV catalog confirms its severity. The agency has not disclosed whether the flaw has been leveraged in ransomware attacks or identified specific threat actors behind the exploitation. Under CISA’s Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies must remediate the vulnerability by March 24, 2026, either by applying patches or discontinuing use of the product if mitigations are unavailable. Private sector organizations are also urged to prioritize fixes, following Broadcom’s official guidance. The vulnerability was initially reported to Broadcom, which released patches and workarounds. However, the confirmation of in-the-wild exploitation underscores the urgency for affected users to act. VMware Aria Operations, formerly known as vRealize Operations (vROps), is widely deployed for monitoring, management, and optimization of hybrid and multi-cloud environments.