Observed In The Wild: New Tag For CVE-2023-20887 — VMWare Aria Operations for Networks
Summary: VMware released an advisory on June 7, 2023 for CVE-2023-20887, a command injection vulnerability in VMware Aria Operations for Networks (formerly vRealize Cloud Management) with a CVSS score of 9.8. A proof of concept was published June 13, 2023 by SinSinology, and GreyNoise reports observing attempted mass-scanning activity using that code to launch a reverse shell connecting back to an attacker-controlled server for further commands.
Bottom line: A 9.8 command injection with public exploit code is already being mass-scanned in the wild, and the reverse shell it opens hands an attacker a persistent channel for further commands on any unpatched Aria Operations for Networks instance.
Read the original at GreyNoise Blog ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2023-20887
- Related
- CVE-2023-20887: Vmware Aria Operations for Networks Command Injection Vulnerability Known Exploited Vulnerabilities · Jun 22, 2023New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026