CVE-2023-20887
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with...
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
- Record
CVE-2023-20887- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE List
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
- Record
CVE-2023-20887- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2023-25058
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
- Record
EUVD-2023-25058- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8vx8-r5j3-f2vf
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with...
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.
- Record
GHSA-8vx8-r5j3-f2vf- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
CISA KEV No score
Vmware Aria Operations for Networks Command Injection Vulnerability
VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.
- Record
CVE-2023-20887- Weakness
- CWE-77
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | VMWare Aria Operations for Networks (vRealize Network Insight) pre-authenticated RCE | 2023-06-07 |
| PoC in GitHub | sinsinology/CVE-2023-20887 | 2023-06-13 |
| PoC in GitHub | miko550/CVE-2023-20887 | 2023-06-14 |
| PoC in GitHub | Malwareman007/CVE-2023-20887 | 2023-09-25 |
| Nuclei | VMware VRealize Network Insight - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-20887 is a critical vulnerability (CVSS 9.8) in Vmware Aria Operations For Networks, published June 7, 2023. CISA lists it as known to be exploited, since June 22, 2023. EUVD reports exploitation since June 22, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.3%, the 99th percentile. No source names a fixed version.
References
vmware.com/security/advisories/VMSA-2023-0012.html
packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20887
nvd.nist.gov/vuln/detail/CVE-2023-20887
github.com/advisories/GHSA-8vx8-r5j3-f2vf