{"id":"CVE-2023-20887","aliases":["EUVD-2023-25058","GHSA-8vx8-r5j3-f2vf"],"status":"published","title":"Aria Operations for Networks contains a command injection vulnerability. A malicious actor with...","description":"Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.98281,"percentile":0.99917,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2023-06-07T14:16:56Z","modified":"2026-06-17T05:31:07Z","kev":{"date_added":"2023-06-22","due_date":"2023-07-13","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-06-22"},{"source":"kev","since":"2023-06-22"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/vmware_vrni_rce_cve_2023_20887","title":"VMWare Aria Operations for Networks (vRealize Network Insight) pre-authenticated RCE","type":"exploit","platform":"Linux,Unix","date":"2023-06-07","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/vmware_vrni_rce_cve_2023_20887"},{"source":"pocgithub","id":"sinsinology/CVE-2023-20887","title":"sinsinology/CVE-2023-20887","date":"2023-06-13","url":"https://github.com/sinsinology/CVE-2023-20887"},{"source":"pocgithub","id":"miko550/CVE-2023-20887","title":"miko550/CVE-2023-20887","date":"2023-06-14","url":"https://github.com/miko550/CVE-2023-20887"},{"source":"pocgithub","id":"Malwareman007/CVE-2023-20887","title":"Malwareman007/CVE-2023-20887","date":"2023-09-25","url":"https://github.com/Malwareman007/CVE-2023-20887"},{"source":"nuclei","id":"CVE-2023-20887","title":"VMware VRealize Network Insight - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-20887.yaml"}],"products":[{"vendor":"vmware","product":"aria operations for networks"},{"vendor":"vmware","product":"aria_operations_for_networks"}],"references":[{"url":"https://www.vmware.com/security/advisories/VMSA-2023-0012.html","tags":["x_transferred","Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/173761/VMWare-Aria-Operations-For-Networks-Remote-Command-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-20887","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-20887"},{"url":"https://github.com/advisories/GHSA-8vx8-r5j3-f2vf"}],"sources":{"cve":[{"id":"CVE-2023-20887","description":"Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.","status":"published","published":"2023-06-07T14:16:56.641Z","modified":"2025-10-21T23:05:46.461Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:35:13.912858Z"}],"euvd":[{"id":"EUVD-2023-25058","description":"Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.","status":"published","published":"2023-06-07T14:16:56Z","modified":"2025-10-21T23:05:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2023-06-22","updated_at":"2026-11-02T20:31:27.312976Z"}],"ghsa":[{"id":"GHSA-8vx8-r5j3-f2vf","title":"Aria Operations for Networks contains a command injection vulnerability. A malicious actor with...","description":"Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.","status":"published","published":"2023-06-07T15:30:17Z","modified":"2025-10-22T00:33:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:04:08.734574Z"}],"kev":[{"id":"CVE-2023-20887","title":"Vmware Aria Operations for Networks Command Injection Vulnerability","description":"VMware Aria Operations for Networks (formerly vRealize Network Insight) contains a command injection vulnerability that allows a malicious actor with network access to perform an attack resulting in remote code execution.","cwes":["CWE-77"],"kev":{"date_added":"2023-06-22","due_date":"2023-07-13","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-20887","description":"Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.","status":"published","published":"2023-06-07T15:15:09.19Z","modified":"2026-06-17T05:31:07.117Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:08:05.329837Z"}]}}