VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/22xxx/CVE-2026-22719.json
T

269 lines
13 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-22719",
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"state": "PUBLISHED",
"assignerShortName": "vmware",
"dateReserved": "2026-01-09T06:54:36.841Z",
"datePublished": "2026-02-25T19:18:59.269Z",
"dateUpdated": "2026-04-14T10:38:25.169Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware",
"dateUpdated": "2026-04-14T10:38:25.169Z"
},
"title": "VMware Aria Operations command injection vulnerability",
"datePublic": "2026-02-24T06:24:00.000Z",
"affected": [
{
"vendor": "VMware",
"product": "VMware Aria Operations",
"packageName": "VMware Aria Operations",
"versions": [
{
"status": "affected",
"version": "8.18.x",
"lessThan": "8.18.6",
"versionType": "custom"
}
],
"defaultStatus": "affected"
},
{
"vendor": "VMware",
"product": "VMware Cloud Foundation Operations",
"packageName": "VMware Cloud Foundation Operations",
"versions": [
{
"status": "affected",
"version": "9.0",
"lessThan": "9.0.2",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.0.2",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.0",
"lessThan": "5.2.3",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "5.2.3"
}
],
"defaultStatus": "affected"
},
{
"vendor": "VMware",
"product": "Telco Cloud Platform",
"packageName": "vmware-telco-cloud-platform",
"versions": [
{
"status": "affected",
"version": "2.0",
"lessThan": "5.2.3",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "5.2.3",
"versionType": "custom"
}
],
"defaultStatus": "affected"
},
{
"vendor": "VMware",
"product": "Telco Cloud Infrastructure",
"packageName": "vmware-telco-cloud-infrastructure",
"versions": [
{
"status": "affected",
"version": "2.0",
"lessThan": "5.2.3",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "5.2.3"
}
],
"defaultStatus": "affected"
}
],
"descriptions": [
{
"lang": "en",
"value": "VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress. \n\nTo remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001 \n\nWorkarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the ' Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ' in VMSA-2026-0001",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.&nbsp;</p><p>To remediate CVE-2026-22719, apply the patches listed in the 'Fixed Version' column of the '<a target=\"_blank\" rel=\"nofollow\" href=\"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947\">Response Matrix</a>' in VMSA-2026-0001&nbsp;</p><p>Workarounds for CVE-2026-22719 are documented in the 'Workarounds' column of the '<a target=\"_blank\" rel=\"nofollow\" href=\"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947\">Response Matrix</a>' in VMSA-2026-0001</p>"
}
]
}
],
"references": [
{
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947",
"name": "VMSA-2026-0001: VMware Aria Operations updates (includes CVE-2026-22719)",
"tags": [
"vendor-advisory"
]
},
{
"url": "https://knowledge.broadcom.com/external/article/430349",
"name": "KB430349: Workaround instructions for CVE-2026-22719",
"tags": [
"mitigation"
]
},
{
"url": "https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html",
"name": "VMware Aria Operations 8.18.6 Release Notes (resolves CVE-2026-22719)",
"tags": [
"release-notes"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseSeverity": "HIGH",
"baseScore": 8.1,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
}
],
"workarounds": [
{
"lang": "en",
"value": "Workarounds are available and documented by the vendor (see  VMSA-2026-0001  KB430349) https://knowledge.broadcom.com/external/article/430349 for environments where immediate patching is not possible.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Workarounds are available and documented by the vendor (see&nbsp; VMSA-2026-0001&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://knowledge.broadcom.com/external/article/430349\">KB430349)</a> for environments where immediate patching is not possible.</p>"
}
]
}
],
"solutions": [
{
"lang": "en",
"value": "Apply the vendor patches listed in the 'Fixed Version' column of the Response Matrix https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947  in VMSA-2026-0001. Fixed versions include VMware Aria Operations 8.18.6 (for 8.x) and VMware Cloud Foundation Operations 9.0.2.0 (for 9.x).",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "<p>Apply the vendor patches listed in the 'Fixed Version' column of the <a target=\"_blank\" rel=\"nofollow\" href=\"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947\">Response Matrix</a>&nbsp;in VMSA-2026-0001.&nbsp;Fixed versions include VMware Aria Operations 8.18.6 (for 8.x) and VMware Cloud Foundation Operations 9.0.2.0 (for 9.x).</p>"
}
]
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
},
"adp": [
{
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-77",
"lang": "en",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"
}
]
}
],
"references": [
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22719",
"tags": [
"government-resource"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-02-24T00:00:00+00:00",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3",
"id": "CVE-2026-22719"
}
}
},
{
"other": {
"type": "kev",
"content": {
"dateAdded": "2026-03-03",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22719"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-03-04T04:55:10.596Z"
},
"timeline": [
{
"time": "2026-03-03T00:00:00.000Z",
"lang": "en",
"value": "CVE-2026-22719 added to CISA KEV"
}
]
}
]
}
}
View Git Blame Copy Permalink