VMware Aria Operations 8.18.x contains a command injection vulnerability (CWE-77) that allows a remote unauthenticated attacker to execute arbitrary commands during support-assisted product migration. This vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction. VMware's advisory VMSA-2026-0001 provides fixed versions and workarounds documented in the Response Matrix linked in the advisory.

Successful exploitation of this vulnerability can lead to remote code execution on the affected VMware Aria Operations system, compromising confidentiality, integrity, and availability of the system. This could allow attackers to take full control of the affected system during the migration process.

Apply the patches listed in the 'Fixed Version' column of the Response Matrix in VMware Security Advisory VMSA-2026-0001. Workarounds are also documented in the same advisory under the 'Workarounds' section. Administrators should consult the advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 for detailed remediation steps. Patch status is confirmed as official fix available.