9.8
Critical
CVE-2023-20887 Vmware Aria Operations for Networks Command Injection Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-77
Description
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Aria Operations for Networks (Formerly vRealize Network Insight) | Versions not published |