Broadcom's VMware virtualization stack has three separate vulnerabilities confirmed exploited and added to CISA's Known Exploited Vulnerabilities catalogue within roughly a five-month window, spanning VMware Aria Operations, VMware vCenter Server, and the Aria/VMware Tools guest agent pairing — a spread that touches the management plane, the hypervisor-adjacent server, and the in-guest agent all at once.
| CVE | CVSS | Component | Added to KEV |
|---|---|---|---|
| CVE-2024-37079 | 9.8 | vCenter Server (DCERPC) | 23 Jan 2026 |
| CVE-2026-22719 | 8.1 | Aria Operations (migration flow) | 3 Mar 2026 |
| CVE-2025-41244 | 7.8 | Aria Operations + VMware Tools | 30 Oct 2025 |
Why one virtualization vendor produced three distinct attack surfaces
Each of these three CVEs lives in a different layer of the same VMware deployment, and that matters more than their shared vendor label. CVE-2024-37079 is a heap out-of-bounds write in vCenter Server's implementation of the DCERPC protocol — an unauthenticated attacker with network reach to vCenter can send a specially crafted packet and potentially achieve remote code execution, with no user interaction and no privileges required (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). vCenter is the single pane of glass that manages an organization's entire virtual machine estate, so a network-reachable memory-corruption bug in its RPC handling is about as central a target as this stack offers.
CVE-2026-22719 sits one layer up, in Aria Operations (formerly vRealize Operations), and is a command injection vulnerability specifically reachable during support-assisted product migration — an unauthenticated actor can execute arbitrary OS commands while a migration is in progress. The "during migration" qualifier is notable: it describes a narrower window of exposure than an always-on service, but migrations are also exactly the kind of maintenance activity that gets scheduled without the same security scrutiny as steady-state operations.
CVE-2025-41244 is different in kind from the other two — it is a local privilege escalation, not a remote one. A non-administrative local actor on a VM that has VMware Tools installed and is managed by Aria Operations with Service Discovery Management Pack (SDMP) enabled can escalate to root on that same VM. That combination — VMware Tools plus Aria-managed SDMP — is a common enterprise configuration for anyone using Aria for application discovery across their VM fleet, which means the privilege escalation path is not an edge case but a default-adjacent one for shops that lean on Aria's discovery features.
What to check this week
Confirm vCenter Server patch level first — CVE-2024-37079's unauthenticated, no-interaction remote code execution path against the platform that manages your entire VM inventory makes it the highest-consequence item in this cluster despite not carrying the top CVSS score of the three.
Audit whether Aria Operations migrations are scheduled or pending — if a migration window is open or upcoming, CVE-2026-22719's exploitation path is live for that duration specifically, so patch or apply Broadcom's documented workarounds before initiating any migration.
Check SDMP enablement in Aria Operations — if Service Discovery Management Pack is turned on and VMware Tools is deployed across your VM fleet, CVE-2025-41244's local-to-root escalation path exists on every VM in that configuration, not just a subset.
Verify patch versions against Broadcom's VMSA-2026-0001 response matrix directly rather than assuming a general VMware update cycle already covered these three, since each was disclosed and patched on its own timeline.
Why "unknown" ransomware use doesn't mean low priority here
All three CVEs in this cluster show "Unknown" for known ransomware campaign use, which is a data-availability gap rather than a safety signal — CISA's KEV catalogue tracks confirmed exploitation, and all three made that list, meaning real-world attackers have already used each of them regardless of whether a ransomware group specifically has been publicly tied to the activity. Treating "Unknown" ransomware use as lower risk than a "Known" tag elsewhere in this series would be a mistake specific to how that field gets populated, not to the actual threat.
A closing note on virtualization as a single point of failure
VMware's stack is deliberately centralizing infrastructure — one vCenter instance can govern hundreds of VMs, and one Aria Operations deployment can span an entire fleet's monitoring and lifecycle management. That concentration is the entire value proposition of virtualization management, and it is also precisely why three confirmed-exploited vulnerabilities against this stack in one KEV window deserve treatment as a single risk conversation rather than three separate, deprioritized tickets.
How Safeguard helps
Safeguard's continuous inventory tracks virtualization management infrastructure — vCenter, Aria Operations, and the guest agents tied to them — with visibility into patch level and configuration state, so a cluster like this one surfaces as a single prioritized finding across the whole VMware estate rather than three disconnected alerts that individually look survivable.
