CVE-2025-22719: VMware Aria Operations RCE Exploited in the Wild

Broadcom has issued an emergency advisory regarding a critical CVE in VMware Aria Operations for Networks, formerly known as vRealize Network Insight. The vulnerability, identified as CVE-2025-22719, allows an unauthenticated attacker to achieve RCE on the appliance. This Zero-Day was recently added to the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming that threat actors are actively leveraging the flaw to compromise enterprise environments. According to SecurityWeek, the vulnerability is rated with a CVSS score of 9.8, categorising it as critical.

Technical Analysis of CVE-2025-22719

The flaw resides in the handling of specific network requests within the Aria Operations for Networks management interface. Because the vulnerability does not require authentication, any attacker with network access to the management console can execute arbitrary commands with the privileges of the underlying service. In many environments, these appliances possess extensive visibility into network traffic and configurations, making them high-value targets for Lateral Movement and data exfiltration.

Once an attacker achieves initial access via CVE-2025-22719, they typically deploy a web shell or a reverse shell to establish persistent C2 communications. This allows for further Privilege Escalation and the deployment of additional Malware. The TTP observed in the wild suggest that attackers are prioritising the discovery of administrative credentials stored within the application to move deeper into the data centre.

How to detect CVE-2025-22719 exploit attempts

Security teams should focus on identifying anomalous traffic patterns directed at the Aria Operations management ports. To effectively understand how to detect CVE-2025-22719 exploit attempts, SOC analysts should monitor for unusual sub-processes spawned by the VMware service accounts, particularly instances of /bin/sh or /bin/bash originating from the web server process. Reviewing application logs for unexpected 500-series errors or malformed API requests can also provide an IoC for early-stage scanning.

Integration with a SIEM is recommended to correlate these events with other suspicious activities, such as internal port scanning or unauthorized access to sensitive database segments. Organizations utilizing EDR solutions should ensure that monitoring is enabled for all virtual appliances, as these are often overlooked during standard security audits.

Remediation for CVE-2025-22719 RCE

The primary mitigation strategy is the immediate application of security patches. Broadcom has released updates for all supported versions, and defenders should consult the official VMware Aria Operations for Networks 6.x patch guidance to ensure their specific build is protected. If immediate patching is not feasible, the management interface should be restricted to trusted internal networks only, and public-facing instances must be taken offline or placed behind a strict VPN or Zero Trust gateway.

Given the active exploitation, incident response teams should conduct a retrospective hunt for any evidence of compromise occurring before the patch was applied. Utilizing the MITRE ATT&CK framework can help map the potential post-exploitation steps, such as Ransomware preparation or sensitive data staging, that follow a successful exploit of this magnitude.