Vmware
Vmware Aria Operations: vulnerabilidades y CVE
Vmware Aria Operations tiene 18 vulnerabilidades publicadas, 6 de ellas en los últimos 12 meses. 1 son críticas y 2 figuran en el catálogo de explotación activa de CISA.
CVE18
Últimos 12 meses6
Críticas1
Explotadas activamente2
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-22719 | Alta (8.1) | 18% | ⚠ Explotación activa | 25 feb 2026 | VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations… |
| CVE-2025-41244 | Alta (7.8) | 8.4% | ⚠ Explotación activa | 29 sept 2025 | VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-41724 | Media (5.4) | 0.32% | — | 8 jun 2026 | VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform… |
| CVE-2026-41723 | Alta (8) | 0.42% | — | 8 jun 2026 | VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform… |
| CVE-2026-41722 | Media (5.4) | 0.32% | — | 8 jun 2026 | VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform… |
| CVE-2026-22721 | Alta (7.2) | 0.71% | — | 25 feb 2026 | VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria… |
| CVE-2026-22720 | Crítica (9) | 0.42% | — | 25 feb 2026 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria… |
| CVE-2026-22719 | Alta (8.1) | 18% | ⚠ Explotación activa | 25 feb 2026 | VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations… |
| CVE-2025-41245 | Media (4.9) | 0.61% | — | 29 sept 2025 | VMware Aria Operations contains an information disclosure vulnerability. A malicious actor with non-administrative privileges in Aria Operations may exploit this vulnerability to disclose credentials of other users of… |
| CVE-2025-41244 | Alta (7.8) | 8.4% | ⚠ Explotación activa | 29 sept 2025 | VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by… |
| CVE-2025-22231 | Alta (7.8) | 0.15% | — | 1 abr 2025 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can escalate their privileges to root on the appliance running VMware Aria Operations. |
| CVE-2025-22222 | Media (6.5) | 0.56% | — | 30 ene 2025 | VMware Aria Operations contains an information disclosure vulnerability. A malicious user with non-administrative privileges may exploit this vulnerability to retrieve credentials for an outbound plugin if a valid… |
| CVE-2024-38834 | Media (4.8) | 0.31% | — | 26 nov 2024 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might be able to inject malicious script leading to stored cross-site scripting in the… |
| CVE-2024-38833 | Media (5.4) | 0.40% | — | 26 nov 2024 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to email templates might inject malicious script leading to stored cross-site scripting in the product… |
| CVE-2024-38832 | Media (6.4) | 0.44% | — | 26 nov 2024 | VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to views may be able to inject malicious script leading to stored cross-site scripting in the product… |
| CVE-2024-38831 | Alta (7.8) | 0.29% | — | 26 nov 2024 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can insert malicious commands into the properties file to escalate privileges to a root… |
| CVE-2024-38830 | Alta (7.8) | 0.18% | — | 26 nov 2024 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger this vulnerability to escalate privileges to root user on the appliance… |
| CVE-2024-22235 | Media (6.7) | 0.19% | — | 21 feb 2024 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'. |
| CVE-2023-34043 | Media (6.7) | 0.19% | — | 27 sept 2023 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'. |
| CVE-2023-20880 | Media (6.7) | 0.22% | — | 12 may 2023 | VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.