VMware Aria Automation vulnerabilities

3 CVEs affecting VMware Aria Automation, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-22249, published 2025-05-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-34063, published 2024-01-16. High severity, CVSS 8.3. EPSS: 0.9% chance of exploitation in the next 30 days. Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and…
CVE-2024-22280, published 2024-07-11. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. VMware Aria Automation does not apply correct input validation which allows for SQL-injection in the product. An authenticated malicious user could enter specially crafted SQL queries and perform…
CVE-2025-22249, published 2025-05-13. High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days. VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation…