CVE-2026-22721: Privilege Escalation in VMware Aria Operations

This vulnerability poses a significant risk to organizations utilizing VMware Aria Operations, as it enables unauthorized privilege escalation. An attacker who already possesses limited access within vCenter can leverage this flaw to bypass access controls and gain full administrative rights within Aria Operations. This could lead to unauthorized configuration changes, data breaches, and potential disruption of monitoring and management operations. The impact is amplified in environments where Aria Operations is tightly integrated with other critical infrastructure components, as a compromised Aria Operations instance could serve as a stepping stone for broader attacks.

1. Reserved2026-01-09
2. Published2026-02-25
3. Modified2026-02-27
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-22721 is to immediately apply the security patch released by VMware. Upgrade to version 9.0.2 or later to address the vulnerability. If upgrading is not immediately feasible, review the VMware Security Advisory (VMSA-2026-0001) for potential temporary workarounds, such as restricting access to Aria Operations from vCenter or implementing stricter authentication policies. Monitor vCenter logs for suspicious activity related to Aria Operations access. After applying the upgrade, confirm remediation by verifying that users with vCenter privileges no longer have the ability to escalate privileges within Aria Operations.