KEV Alert: Active exploits in VMware Aria Operations force to park before March 24

The US cyber security agency CISA has included a vulnerability in VMware Aria Operations - registered as CVE-2026-22719- in its catalogue of Known Exploited Vulnerabilities (KEV), which indicates that the problem is already being exploited in real attacks. This decision implies that U.S. federal civil agencies have an obligation to mitigate the failure by March 24, 2026, a time frame that underlines the seriousness of the case and the need to act quickly.

VMware Aria Operations is a monitoring platform designed for business environments: it helps control the performance and health of servers, networks and cloud resources. The ruling, which VMware and Broadcom published and parked on 24 February 2026 within the notice VMSA-2026-0001, was listed as "Important" with an approximate CVSS score of 8.1, which already pointed to a high risk if not corrected quickly.

According to the manufacturer, this is a command injection vulnerability that would allow an unauthenticated attacker to execute arbitrary orders in vulnerable systems; at worst, this could lead to remote code execution while a support-assisted migration process is under way. In other words, a vector related to migration utilities turns a legitimate functionality into a dangerous entry door if the corrections are not applied.

Broadcom, responsible for the support of Aria Operations, published patches on the same February 24 and also provided a temporary solution for those who cannot immediately deploy the update. The official patch and mitigation guide are available in the Broadcom safety notice; the interim solution is to run as root a script called aria-ops-rce-workaround.sh, which disables components of the migration process that could be exploited and removes an entry in sudoers that allowed a workflow script to run with high privileges without asking for password. Broadcom updated its notice, noting that they have received reports of exploitation in nature, but that they have not been able to independently validate these reports: detail of Broadcom.

It is important to note that, so far, no technical details have been published that explain exactly how vulnerability is being exploited in real attacks. This lack of public information complicates the detection of commitments, because the response teams do not have comprehensive and contrasting commitment indicators. Therefore, the general recommendation of manufacturers and CISA is to have priority in the application of the patch or, if not possible, to deploy temporary mitigation and to tighten controls around the affected instances.

For managers and security officials this means, in addition to patching as soon as possible, avoiding unnecessarily exposing management consoles and limiting access to Aria Operations nodes from unreliable networks. It is also appropriate to review records for unusual activity, to check the integrity of migration-related binaries and scripts, and to rotate administrative credentials if there is the least suspicion of commitment. Broadcom publishes the temporary measure and additional steps in its knowledge base Here..

The inclusion of CVE-2026-22719 in the KEV catalogue of CISA is a call for attention: when the agency acts in this way it is usually because there is evidence, direct or indirect, of active use in malicious campaigns and because the risk for critical infrastructure is considered significant. This is not the first recent case where vulnerabilities in virtualization and management products have become attractive vectors for attackers, so security teams should treat this warning with the highest operational priority.

If you manage Aria Operations, the essential thing is to check the version you run in front of the VMware correction list, apply the patches provided by the manufacturer and, in the meantime, implement any workaround approved by Broadcom. Keeping an eye on manufacturer updates and agency notices such as CISA will help to adjust the response if new technical details on operating techniques appear.