CVE-2026-22721

CVE Enrichment

CVSS: 7.2 HIGH
EPSS: 0.74%
EPSS Percentile: 54.76%
CISA KEV: Not listed

Description

VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found in VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 .

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 26-Feb-2026 04:16
Last Modified: 17-Jun-2026 17:20
EPSS Date: 2026-11-06
CWE: CWE-269

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:H /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CNA Products / Version Status

VMware · VMware Aria Operations Source: CNA · [email protected]
Default status: affected

8.18.0 ≤ version < 8.18.6 — affected (custom)
8.18.6 — unaffected

packageName: vmware-aria-operations
VMware · VMware Cloud Foundation Source: CNA · [email protected]
Default status: affected

4.0 ≤ version < 5.2.3 — affected (custom)
9.0 ≤ version < 9.0.2 — affected (custom)
5.2.3 — unaffected
9.0.2 — unaffected

packageName: vmware-cloud-foundation-operations
VMware · VMware Telco Cloud Infrastructure Source: CNA · [email protected]
Default status: affected

2.0 ≤ version < 5.2.3 — affected (custom)
5.2.3 — unaffected (custom)

packageName: vmware-telco-cloud-infrastructure
VMware · VMware Telco Cloud Platform Source: CNA · [email protected]
Default status: affected

4.0 ≤ version < 5.2.3 — affected (custom)
5.2.3 — unaffected (custom)

packageName: vmware-telco-cloud-platform

Affected Products / Versions

vmware / aria_operations Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 8.0 · before (exclusive) 8.18.6
cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:*
vmware / cloud_foundation Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 4.0 · before (exclusive) 5.2.3
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
vmware / cloud_foundation Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 9.0 · before (exclusive) 9.0.2.0
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
vmware / telco_cloud_infrastructure Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.2 · through (inclusive) 3.0
cpe:2.3:a:vmware:telco_cloud_infrastructure:*:*:*:*:*:*:*:*
vmware / telco_cloud_platform Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 4.0 · through (inclusive) 5.1
cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*

References

Last enrichment sync: 07-Nov-2026 09:49
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

(Langflow critical), CVE-2026-4342 (Kubernetes ingress-nginx configuration injection), and CVE-2026-22721 (VMware Aria privilege escalation). Cyble Weekly Report Highlights Vulnerabilities Across AI, VMware and ICS

CVE (7)

MITRE ATT&CK (5)

Vendors (8)

Products (10)

Industries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.