LiveThreat Vulnerability Brief — CVE‑2026‑21385 & CVE‑2026‑22719
What It Is — CISA has added two actively exploited flaws to its Known Exploited Vulnerabilities (KEV) Catalog: a memory‑corruption issue affecting multiple Qualcomm chipsets (CVE‑2026‑21385) and a command‑injection bug in Broadcom’s VMware Aria Operations platform (CVE‑2026‑22719). Both vulnerabilities are being leveraged in the wild to achieve arbitrary code execution or privilege escalation. Exploitability — Confirmed active exploitation; public PoCs have been observed for the Qualcomm flaw, and Broadcom reports ongoing attacks against Aria Operations customers. CVSS scores are pending but are expected to be in the High range (≥7.0).
Affected Products — Qualcomm multiple SoC families used in IoT, automotive, and mobile devices; Broadcom‑delivered VMware Aria Operations (formerly vRealize Operations) used for infrastructure monitoring in cloud and data‑center environments.
TPRM Impact — Supply‑chain exposure for any organization that sources hardware or services built on Qualcomm chipsets or relies on Broadcom‑managed monitoring tools. Compromise could cascade to downstream SaaS offerings, data‑center workloads, or embedded systems, raising the risk of data loss, service interruption, and reputational damage.
Recommended Actions — 1️⃣ Verify inventory for any Qualcomm‑based devices or Broadcom‑managed Aria Operations deployments. 2️⃣ Prioritize patching per vendor guidance; apply interim mitigations (e.g., firmware roll‑backs, configuration hardening) where patches are unavailable. 3️⃣ Align remediation timelines with CISA’s BOD 22‑01 deadline. 4️⃣ Conduct targeted threat‑intel monitoring for exploitation indicators. 5️⃣ Update third‑party risk registers to reflect elevated risk scores. Source: CISA Advisory – 2026‑03‑03