CVE-2026-22721 VMware Aria Operations privilege escalation vulnerability

Medium 6.2 Published 25 Feb 2026 Updated 27 Feb 2026

A malicious actor with vCenter access can escalate privileges to obtain administrative control over VMware Aria Operations.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-22721?

CVE-2026-22721 is a medium-severity vulnerability in Vmware Cloud Foundation, published on 25 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found in VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 .

Weakness: CWE-269

Which versions are affected by CVE-2026-22721?

It affects 4 products.

Products include Vmware Aria Operations, Vmware Cloud Foundation, Vmware Telco Cloud Infrastructure, Vmware Telco Cloud Platform.

How do I fix CVE-2026-22721?

No fix has been published for CVE-2026-22721 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-22721 being exploited?

There is no known exploitation of CVE-2026-22721 in the wild and no public exploit code.

All Vmware Cloud Foundation vulnerabilities

Sources

Also known as GHSA-p743-h3f6-5f74.