嗯，用户让我用中文总结一篇文章，控制在100字以内，而且不需要用“文章内容总结”之类的开头。首先，我得仔细阅读这篇文章，抓住主要内容。 文章主要讲的是美国网络安全和基础设施安全局（CISA）将高通、博通和VMware Aria Operations的漏洞加入到已知被利用的漏洞目录中。具体来说，有CVE-2026-22719和CVE-2026-21385两个漏洞，评分分别是8.1和7.8。这两个漏洞都比较严重，一个是命令注入，另一个是内存腐败。 博通在二月份发布了安全更新来修复VMware Aria Operations中的多个漏洞，包括CVE-2026-22719。这个平台用于IT运营监控和优化。而高通的漏洞影响了多个芯片组，可能导致敏感数据泄露。 CISA要求联邦机构在3月24日之前修复这些漏洞，并建议私营组织也检查和修复自己的系统。 总结的时候要简明扼要，涵盖CISA添加了哪些漏洞、影响以及应对措施。控制在100字以内的话，可能需要精简一些细节。 最后确保语言流畅自然，不使用生硬的开头。 </think> 美国网络安全机构CISA将高通、博通及VMware Aria Operations的两个高危漏洞加入已知被利用漏洞目录。其中博通VMware Aria Operations存在命令注入漏洞（CVE-2026-22719），CVSS评分8.1；高通多款芯片组内存腐败漏洞（CVE-2026-21385），CVSS评分7.8。这些漏洞可能导致远程代码执行或敏感数据泄露。CISA要求联邦机构于3月24日前修复相关问题。 2026-3-4 08:56:38 Author: securityaffairs.com(查看原文) 阅读量:27 收藏
U.S. CISA adds Qualcomm and Broadcom VMware Aria Operations flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Qualcomm and Broadcom VMware Aria Operations flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Google Chromium CSS, Microsoft Windows, TeamT5 ThreatSonar Anti-Ransomware, and Zimbra flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Below are the flaws added to the catalog:
- CVE-2026-22719 (CVSS score of 8.1) Broadcom VMware Aria Operations Command Injection Vulnerability
- CVE-2026-21385 (CVSS score of 7.8) Qualcomm Multiple Chipsets Memory Corruption Vulnerability
In February, Broadcom released security updates to address multiple vulnerabilities affecting VMware Aria Operations, including CVE-2026-22719.
VMware Aria Operations is an IT operations management platform that helps organizations monitor and optimize virtual, cloud, and hybrid environments. It provides performance monitoring, capacity planning, automated alerting, and cost analysis, giving IT teams greater visibility and control over infrastructure to ensure efficiency, reliability, and compliance.
The vulnerability is a command injection flaw that an unauthenticated attacker can exploit remotely.
“A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.” reads the advisory.
This vulnerability was privately reported to Broadcom.
The second vulnerability added to the Kev catalog is CVE-2026-21385, a Qualcomm multiple chipsets memory corruption issue. The flaw is a buffer over-read in the Graphics component that could allow attackers to access sensitive memory data, underscoring ongoing risks to Android users.
Google has confirmed that CVE-2026-21385 (CVSS score of 7.8), a high-severity vulnerability affecting an open-source Qualcomm component used in Android devices, has been actively exploited.
“There are indications that CVE-2026-21385 may be under limited, targeted exploitation.” reads Google’s advisory.
“A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress.” reads the advisory.
This vulnerability was privately reported to Broadcom.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the vulnerabilities by March 24, 2026.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
如有侵权请联系:admin#unsafe.sh