Broadcom released various patches to tackle vulnerabilities concerning its Aria multicloud management platform.

The new advisory revealed VMware Aria Operations is at risk from a triple threat of a command injection vulnerability (CVE-2026-22719), a stored cross-site scripting vulnerability (CVE-2026-22720), and a privilege escalation vulnerability (CVE-2026-22721). The Aria issues affect overarching platforms such as VMware Cloud Foundation (VCF), and VMware’s Telco Cloud Platform and Infrastructure offerings.

According to Broadcom, a malicious unauthenticated actor may exploit the command injection vulnerability to execute arbitrary commands, with the possibility of remote code execution (RCE) in Aria Operations while support-assisted product migration is taking place.

The cross-site scripting vulnerability, meanwhile, allows a bad actor with privileges to create custom benchmarks and inject scripts to perform administrative actions within Aria. Similarly, a malicious actor with privileges in vCenter to access Aria Operations can leverage the privilege escalation flaw to obtain administrative access.

Each of the responsibilities were privately disclosed to Broadcom, and there is currently no indication of active exploitation in the wild. In response, the firm issued patches for the various suites, alongside VMware vSphere Foundation.

Broadcom's disclosure comes after a VMware security issue was flagged by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as a federal threat. Designated as CVE-2024-37079, the exploit enables RCE or privilege escalation via the use of a specially made network packet in VMware's centralized management utility, vCenter Server.

A separate security briefing from the National Security Agency (NSA) in conjunction with CISA revealed a backdoor exploit for VMware vSphere. Disclosed in December, the breach allowed malicious actors to grab cloned virtual machine (VM) snapshots for credential extraction and create hidden, rogue VMs via vCenter servers and the VMware ESXI hypervisor.

In addition, an exploitation campaign was revealed in January, where a custom exploit chain was used by attackers to break out of a VMware guest VM and execute malicious code on the ESXI hypervisor itself.