Keeping your Aria Operations environment up to date is crucial for maintaining performance, stability, and access to the latest features. In this post, we’ll walk through the process of applying a hotfix to Aria Operations using Aria Suite Lifecycle Manager. Whether you’re addressing a specific issue or preparing for a broader upgrade, this guide ensures a smooth and efficient update experience.
We are addressing the update from Aria Operations 8.18.3 towards 8.18.3-HF5, because of VMware Security Advisory VMSA-2025-0006 (CVSSv3 : 7.8). The Hotfix for CVE-2025-22231 is available for both versions 8.18 and 8.18.3. The update from 8.18 will ultimately install target version 8.18.3-HF5 as well.
The following steps are required
Check Interoperability
It is important to check for interoperability between your software components. For example, components such as SDDC Manager, Aria Suite Lifecycle itself and Aria Operations for Logs Example : click here for an example Interoperability Result
Make sure Aria Suite Lifecycle is up-to-date
Aria Suite Lifecycle should be able to implement the hotfix. While navigating Aria Suite Lifecycle, go to Lifecycle Operations > Settings > Product Support Pack
Check if the latest Product Support Pack supports the required Hotfix; if you want to install the 8.18.3-HF5 Hotfix, then Aria Operations 8.18.3 should be in the listing. In other words: update to the latest Product Support Pack, sooner than later.
Otherwise, it is relatively easy to upload the Product Support Pack from the above interface, and have Aria Suite Lifecycle updated with the latest PSP.
A direct link to download the Product Support Packs is not easy to find, but can be found here, as discussed in my previous post.
Prepare Aria Suite Lifecycle
Next step is to prepare Aria Suite Lifecycle with the binary. Although Aria Suite Lifecycle 8.18.3 PSP5 is compliant with Aria Operation 8.18.3-HF5, it cannot download the PATCH file by itself. For this, the binary needs to be uploaded manually, since it cannot be uploaded through Aria Suite Lifecycle Manager GUI.
- Download it through KB392307, and eventually this link.
- Upload the file (using WinSCP) to your Aria Suite Lifecycle appliance, and put in folder /data/patches/vrops/8.18.3/ (create folder with permissions 0755)
- In Aria Suite Lifecycle, navigate to Settings > Binary Mapping > Patch Binaries > Add Patch Binary
- The Patch has been found and click OK
- The upload patch request has been created
- When the flow completes, you will find the uploaded Hotfix listed in the Binary Mapping > Patch Binaries list
- Now we have uploaded and registered the downloaded PATCH file in Aria Suite Lifecycle, we can proceed with the steps before the implementation of the Aria Operations patch.
- Shut down the guest OS of Aria Suite Lifecycle appliance using the management vCenter using shut down guest OS, and create an offline snapshot. Then turn the VM on again afterwards.
- Login to the Aria Suite Lifecycle Manager with your SSH key to validate authorized keys
- Ensure affected components are in healthy state.
- Trigger inventory sync for the environments (Aria Operations) and make sure the request finishes successfully
- Check the Aria Operations cluster status
- Login to the Aria Operations Admin page at https://[AriaOps-FQDN]/admin and navigate to System Status
- Make sure no critical Aministrative Alerts are visible in Aria Operations itself; navigate to Troubleshoot > Alerts > Administrative Alerts
- Login to the Aria Operations Admin page at https://[AriaOps-FQDN]/admin and navigate to System Status
- Create a snapshot; navigate to Operations > Snapshot > Create snapshot
Fill out the details; make sure the Aria Operations nodes are shutdown using the checkmark (Shutdown before taking snapshot). Click Next
Run a Pre-check, wait for a few moments and click Finish
The snapshot flow commences. Wait 10-15 minutes until Aria Operations comes back online
- Trigger an Inventory Sync from Aria Suite Lifecycle; navigate to Environments > Select Environment > Operations > Actions (ellipsis) > Trigger Inventory Sync
You can follow this in the flow request
- The moment of truth: the installation of the patch
- Navigate to Operations > Patches > Install patch
- Select the uploaded Hotfix
- Review and install
- You can follow the request in the flow; navigate to Requests for this
- In the process, you will see that the Aria Operations cluster is brought offline
- Installation of patches takes place; Aria Operations Admin page > Software Update. Note: the nodes of the cluster might be disconnected. Connect to multiple nodes to keep on tracking the process, since the Aria Suite Lifecycle flow does not give too much information
- Eventually it completes from Aria Operations itself
- Which results in a completed Aria Suite Lifecycle flow
- Aria Operations is updated to0 8.18.3-HF5 !
- If you have Cloud Proxies running, they will be updated in the minutes that follow:
- Navigate to Operations > Patches > Install patch
- As always, make sure your Monitoring functionality is back online, notifications are back.
- Also, if the upgrade is still successfull after two days, you can remove the snapshots through Aria Suite Lifecycle, as well as removing the binaries from the Binary Mapping
Product Patches: https://[AriaSuite-FQDN]/lcm/lcops/settings/binary-mapping/product-patch-binaries
Great job!
You are well protected against CVE-2025-22231 with CVSSv3 score 7.8 !!!