U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Qualcomm and Broadcom VMware Aria Operations flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Chromium CSS, Microsoft Windows, TeamT5 ThreatSonar Anti-Ransomware, and Zimbra flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Below are the flaws added to the catalog:
- CVE-2026-22719 (CVSS score of 8.1) Broadcom VMware Aria Operations Command Injection Vulnerability
- CVE-2026-21385 (CVSS score of 7.8) Qualcomm Multiple Chipsets Memory Corruption Vulnerability
In February, Broadcom released security updates to address multiple vulnerabilities affecting VMware Aria Operations, including CVE-2026-22719.
VMware Aria Operations is an IT operations management platform that helps organizations monitor and optimize virtual, cloud, and hybrid environments. It provides performance monitoring, capacity planning, automated alerting, and cost analysis, giving IT teams greater visibility and control over infrastructure to ensure efficiency, reliability, and compliance.
The vulnerability is a command injection flaw that an unauthenticated attacker can exploit remotely.
“A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.” reads the advisory.
This vulnerability was privately reported to Broadcom.
The second vulnerability added to the Kev catalog is CVE-2026-21385, a Qualcomm multiple chipsets memory corruption issue. The flaw is a buffer over-read in the Graphics component that could allow attackers to access sensitive memory data, underscoring ongoing risks to Android users.
Google has confirmed that CVE-2026-21385 (CVSS score of 7.8), a high-severity vulnerability affecting an open-source Qualcomm component used in Android devices, has been actively exploited.
“There are indications that CVE-2026-21385 may be under limited, targeted exploitation.” reads Google’s advisory.
“A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.” reads the advisory.
This vulnerability was privately reported to Broadcom.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by March 24, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
