Detect CVE-2026-22719: VMware Aria Operations Command Injection in Google Chronicle
Detects exploitation of CVE-2026-22719, a command injection vulnerability (CWE-77) in Broadcom VMware Aria Operations. This KEV-listed vulnerability allows attackers to inject and execute arbitrary OS commands through unsanitized input, potentially leading to full host compromise, lateral movement, and persistence within virtualized environments.
MITRE ATT&CK
YARA-L Detection Query
rule cve_2026_22719_aria_ops_command_injection {
meta:
author = "df00tech Detection Engineering"
description = "Detects command injection exploitation of CVE-2026-22719 in VMware Aria Operations via suspicious child process execution"
severity = "CRITICAL"
confidence = "MEDIUM"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-22719"
events:
$parent.metadata.event_type = "PROCESS_LAUNCH"
$parent.principal.process.file.full_path = /(?i)(vrops|vcops|aria|vmware-vcops|casa)/ nocase
$child.metadata.event_type = "PROCESS_LAUNCH"
$child.principal.process.file.full_path = /(?i)(\bsh\b|bash|python|perl|curl|wget|ncat|netcat|whoami|\bid\b|uname)/ nocase
$child.principal.process.parent_process.file.full_path = $parent.principal.process.file.full_path
$parent.metadata.event_timestamp.seconds = $child.metadata.event_timestamp.seconds
match:
$child.principal.hostname over 30s
outcome:
$risk_score = 90
$target_host = $child.principal.hostname
$cmd = $child.principal.process.command_line
condition:
$parent and $child
}Chronicle YARA-L rule detecting VMware Aria Operations parent processes spawning shell or recon utilities, a behavioral indicator of CVE-2026-22719 command injection exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Built-in Aria Operations automation tasks that legitimately call shell utilities for monitoring
- Vendor-signed maintenance scripts triggered by alert thresholds within the product
- Red team or penetration testing exercises against the Aria Operations environment
Other platforms for CVE-2026-22719
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated Aria Operations Command Injection via curl
Expected signal: Linux audit log EXECVE record for 'id' with ppid matching an Aria Operations web service process; file creation event in /tmp/ by the service account.
- Test 2Post-Exploitation Reverse Shell Staging from Aria Operations Context
Expected signal: Audit log EXECVE for bash and curl with parent 'sudo'; network connection from host to attacker-lab.internal on port 80; file creation event for /tmp/.aria_agent.
- Test 3Recon Execution Simulating Aria Operations Command Injection Output
Expected signal: Linux audit EXECVE records for id, whoami, uname, cat, ss all with uid matching the vmware service account; all spawned as children of bash.
- Test 4Persistence via Cron Injection Simulating Post-Exploitation
Expected signal: Audit log records for bash and crontab execution under vmware service account; file write to vmware user crontab spool (/var/spool/cron/crontabs/vmware).
Unlock Pro Content
Get the full detection package for CVE-2026-22719 including response playbook, investigation guide, and atomic red team tests.