CVE-2023-34039: VMware Aria Operations for Networks SSH authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, high EPSS, and public exploit references make this an urgent management-plane exposure.

What it is

Aria Operations for Networks generates non-unique cryptographic keys, allowing SSH authentication to be bypassed. An attacker with network reachability can log into the appliance CLI without valid credentials, which exposes a management interface that can lead to further compromise.

Impact

An unauthenticated attacker gains CLI access to the Aria Operations for Networks appliance, enabling configuration changes, data access and potential remote code execution on the management plane.

Attack surface

Reachable over the network via SSH to the Aria Operations for Networks appliance; no authentication or user interaction is required per the CVSS vector (AV:N/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is high (0.67, 99th percentile) and public exploit references exist, including an SSH private key exposure write-up, indicating practical exploitation is likely.

What to do

• Apply the vendor patch from VMware advisory VMSA-2023-0018 immediately.
• Restrict SSH access to Aria Operations for Networks to trusted management networks and jump hosts.
• Rotate any SSH keys or credentials associated with the appliance after patching.
• Monitor for unauthorized CLI logins and configuration changes on the appliance.
• If patching is delayed, isolate the appliance from untrusted networks.

Detection

• Alert on SSH logins to Aria Operations for Networks from unexpected source IPs or at unusual times.
• Audit appliance CLI command history and configuration changes for unauthorized activity.
• Hunt for use of the publicly exposed SSH private key material against the appliance.
• Review network flows to the appliance's SSH port from outside approved management segments.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.