# CVE-2025-22719: VMware Aria Operations RCE Exploited in the Wild

> CVE-2025-22719 is a critical remote code execution vulnerability in VMware Aria Operations for Networks currently being exploited by unauthenticated attackers.

- Published: 2026-03-04T08:15:00.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: CVE-2025-22719, VMware, Aria Operations, RCE, Broadcom, Exploitation
- Author: Runtime Rebel Intel
- Primary source: https://www.securityweek.com/vmware-aria-operations-vulnerability-exploited-in-the-wild/
- Canonical: https://runtimerebel.com/blog/cve-2025-22719-vmware-aria-operations-rce-exploited-in-the-wild

## Key points

- Unauthenticated attackers can gain remote code execution on vulnerable VMware instances, leading to full system compromise.
- VMware Aria Operations for Networks versions 6.x are impacted by this critical vulnerability.
- Organizations must apply the latest security patches provided by Broadcom to mitigate active exploitation risks.

Broadcom has issued an emergency advisory regarding a critical [CVE](/glossary#cve) in VMware Aria Operations for Networks, formerly known as vRealize Network Insight. The vulnerability, identified as [CVE-2025-22719](https://nvd.nist.gov/vuln/detail/CVE-2025-22719), allows an unauthenticated attacker to achieve [RCE](/glossary#rce) on the appliance. This [Zero-Day](/glossary#zero-day) was recently added to the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming that threat actors are actively leveraging the flaw to compromise enterprise environments. According to [SecurityWeek](https://www.securityweek.com/vmware-aria-operations-vulnerability-exploited-in-the-wild/), the vulnerability is rated with a [CVSS](/glossary#cvss) score of 9.8, categorising it as critical.

## Technical Analysis of CVE-2025-22719

The flaw resides in the handling of specific network requests within the Aria Operations for Networks management interface. Because the vulnerability does not require authentication, any attacker with network access to the management console can execute arbitrary commands with the privileges of the underlying service. In many environments, these appliances possess extensive visibility into network traffic and configurations, making them high-value targets for [Lateral Movement](/glossary#lateral-movement) and data exfiltration.

Once an attacker achieves initial access via CVE-2025-22719, they typically deploy a web shell or a reverse shell to establish persistent [C2](/glossary#c2) communications. This allows for further [Privilege Escalation](/glossary#privilege-escalation) and the deployment of additional [Malware](/glossary#malware). The [TTP](/glossary#ttp) observed in the wild suggest that attackers are prioritising the discovery of administrative credentials stored within the application to move deeper into the data centre.

### How to detect CVE-2025-22719 exploit attempts

Security teams should focus on identifying anomalous traffic patterns directed at the Aria Operations management ports. To effectively understand how to detect CVE-2025-22719 exploit attempts, [SOC](/glossary#soc) analysts should monitor for unusual sub-processes spawned by the VMware service accounts, particularly instances of `/bin/sh` or `/bin/bash` originating from the web server process. Reviewing application logs for unexpected 500-series errors or malformed API requests can also provide an [IoC](/glossary#ioc) for early-stage scanning.

Integration with a [SIEM](/glossary#siem) is recommended to correlate these events with other suspicious activities, such as internal port scanning or unauthorized access to sensitive database segments. Organizations utilizing [EDR](/glossary#edr) solutions should ensure that monitoring is enabled for all virtual appliances, as these are often overlooked during standard security audits.

## Remediation for CVE-2025-22719 RCE

The primary mitigation strategy is the immediate application of security patches. Broadcom has released updates for all supported versions, and defenders should consult the official VMware Aria Operations for Networks 6.x patch guidance to ensure their specific build is protected. If immediate patching is not feasible, the management interface should be restricted to trusted internal networks only, and public-facing instances must be taken offline or placed behind a strict VPN or [Zero Trust](/glossary#zero-trust) gateway.

Given the active exploitation, incident response teams should conduct a retrospective hunt for any evidence of compromise occurring before the patch was applied. Utilizing the [MITRE ATT&CK](/glossary#mitre-att-ck) framework can help map the potential post-exploitation steps, such as [Ransomware](/glossary#ransomware) preparation or sensitive data staging, that follow a successful exploit of this magnitude.

**Related:** [Automated Reconnaissance Targeting React2Shell Implementations](/blog/automated-reconnaissance-targeting-react2shell-implementations), [VMware Aria Operations CVE-2026-22719 Exploited - Mitigation Guide](/blog/vmware-aria-operations-cve-2026-22719-exploited-mitigation-guide)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2025-22719-vmware-aria-operations-rce-exploited-in-the-wild