VMware Aria Operations 权限提升漏洞

攻击者可以利用此漏洞绕过正常的身份验证和授权机制，从而获得对 VMware Aria Operations 环境的未经授权的控制权。这可能导致敏感数据的泄露、配置更改、甚至整个系统的破坏。攻击者可以利用此漏洞进行横向移动，访问其他连接到 vCenter 的系统。由于 VMware Aria Operations 通常用于监控和管理关键基础设施，因此该漏洞的潜在影响非常严重，可能影响整个企业运营。

Organizations heavily reliant on VMware Aria Operations for monitoring and management are particularly at risk. This includes those with complex vCenter environments, shared vCenter instances, or legacy Aria Operations deployments that have not been regularly patched. Environments where Aria Operations is used to manage critical infrastructure components are also at heightened risk.

• vmware: Examine Aria Operations logs for unusual privilege elevation attempts. Use VMware vSphere CLI to audit user permissions and access controls.

# Example: Check user permissions in vSphere
esxcli user perf-manager/get --username <username>

• generic web: Monitor Aria Operations web interface access logs for suspicious login attempts or unauthorized configuration changes.

grep "<vcenter_ip>" /var/log/apache2/access.log

1. 2026-02-25Disclosure

   disclosure

1. 已保留2026-01-09
2. 发布日期2026-02-25
3. 修改日期2026-02-27
4. EPSS 更新日期2026-03-23

Broadcom 建议用户尽快应用 VMSA-2026-0001 中列出的补丁，将 VMware Aria Operations 更新到 9.0.2 或更高版本。如果无法立即升级，可以考虑限制对 Aria Operations 的访问，仅允许授权用户访问。此外，实施严格的 vCenter 访问控制策略，确保只有必要的用户才能访问 Aria Operations。升级后，请验证 Aria Operations 版本是否已成功更新，并检查系统日志中是否有任何异常活动。