Critical Command Injection in Broadcom VMware Aria Operations (CVE‑2026‑22719) Enables Unauthenticated Remote Code Execution
What It Is — Broadcom VMware Aria Operations (formerly vRealize Operations) contains an unauthenticated command‑injection flaw that can be leveraged to execute arbitrary OS commands. The vulnerability can lead to remote code execution (RCE) during a support‑assisted product migration.
Exploitability — The flaw is exploitable without authentication; proof‑of‑concept code is publicly available. CVSS v3.1 base score is 9.8 (Critical).
Affected Products — Broadcom VMware Aria Operations (vRealize Operations) – all supported versions prior to the vendor‑released patch.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability monitoring and rapid patch deployment as evidence of a mature vulnerability‑management control.
- Provides audit‑ready logs showing when the patch was applied, supporting a defensible posture during third‑party risk assessments.
- Highlights the importance of maintaining an up‑to‑date configuration baseline, a control objective that maps to multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
Recommended Actions
- Identify all Aria Operations instances in scope and verify current version.
- Apply the Broadcom‑issued security patch immediately; document the remediation in your change‑management system.
- Update your vulnerability‑management program to include this CVE in regular scans and evidence collection.
- Verify that logging of patch deployment and post‑patch validation is retained for audit purposes.
Source: CISA KEV – CVE‑2026‑22719