Known vulnerabilities in VMware Aria Operations (formerly vRealize Operations) 8.6.4 20823815

Vendor: VMware, Inc
Software: VMware Aria Operations (formerly vRealize Operations)
Version: 8.6.4 20823815
Software CPE: cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:*
Website: https://www.vmware.com
Total vulnerabilities: 17
Public exploits: 0
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.2

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting VMware Aria Operations (formerly vRealize Operations) version 8.6.4 20823815 VMware Aria Operations (formerly vRealize Operations) 8.6.4 20823815 is affected by 17 vulnerabilities: 1 critical, 1 high, 1 medium, 14 low Critical High Medium Low

Vulnerabilities (17)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134435 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-41722		 CWE-79 Low
No
No
 8.18.6 12.06.2026 SB2026061224
#VU134436 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-41723		 CWE-79 Low
No
No
 8.18.6 12.06.2026 SB2026061224
#VU134437 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-41724		 CWE-79 Low
No
No
 8.18.7 12.06.2026 SB2026061224
#VU123149 - Permissions, Privileges, and Access Controls
CVE-2026-22721		 CWE-264 Low
No
No
 8.18.6, 9.0.2.0 24.02.2026 SB2026022402
#VU123148 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-22720		 CWE-79 Low
No
No
 8.18.6, 9.0.2.0 24.02.2026 SB2026022402
#VU123146 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-22719		 CWE-78 Critical
No
Exploited
 8.18.6, 9.0.2.0 24.02.2026 SB2026022402
#VU116188 - Exposure of sensitive information to an unauthorized actor
CVE-2025-41245		 CWE-200 Low
No
No
 8.18.5 30.09.2025 SB2025093025
#VU116185 - Improper Access Control
CVE-2025-41244		 CWE-284 High
No
Exploited
 8.18.5 30.09.2025 SB2025093024
SB2025093025
SB2025093036
and 21 more
#VU106378 - Permissions, Privileges, and Access Controls
CVE-2025-22231		 CWE-264 Low
No
No
 8.18.5 02.04.2025 SB2025040209
#VU103462 - Exposure of sensitive information to an unauthorized actor
CVE-2025-22222		 CWE-200 Low
No
No
 8.18.3 31.01.2025 SB2025013103
#VU101004 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-38834		 CWE-79 Low
No
No
 8.18.2 27.11.2024 SB2024112760
#VU101003 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-38833		 CWE-79 Low
No
No
 8.18.2 27.11.2024 SB2024112760
#VU101002 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-38832		 CWE-79 Low
No
No
 8.18.2 27.11.2024 SB2024112760
#VU101001 - Improper Privilege Management
CVE-2024-38831		 CWE-269 Low
No
No
 8.18.2 27.11.2024 SB2024112760
#VU101000 - Improper Privilege Management
CVE-2024-38830		 CWE-269 Low
No
No
 8.18.2 27.11.2024 SB2024112760
#VU81196 - Improper input validation
CVE-2023-34043		 CWE-20 Low
No
No
 8.6.11, 8.10.9, 8.12.5 26.09.2023 SB2023092666
#VU71712 - Cross-Site Request Forgery (CSRF)
CVE-2023-20856		 CWE-352 Medium
No
No
 8.6.4 21139695 31.01.2023 SB2023013122