What is CVE-2026-22721?
VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found in VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 .
The record classifies CVE-2026-22721 under weakness class CWE-269. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs high-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity. 4 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 222 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 6.2 — MEDIUM
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L - EPSS (FIRST)
- 0.0% probability of exploitation in the next 30 days, higher than 8.4% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 3.4/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2026-02-25, last modified 2026-03-04
Is CVE-2026-22721 being exploited?
It currently carries a trending score of 7 in the Threadlinqs vulnerability feed.
Affected products and versions
- Vmware: Aria Operations, Cloud Foundation, Telco Cloud Infrastructure, Telco Cloud Platform
How to fix CVE-2026-22721
The record marks a vendor fix as available for CVE-2026-22721. Vendor advisory: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.
Threat activity tracking CVE-2026-22721
1 tracked threat in the Threadlinqs corpus references CVE-2026-22721, either in the campaign’s CVE list or as an indicator on the campaign record.
Sources
Seeded from threadlinqs-intel and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.