Yes, you can run Aria Operations in an air-gapped VVF/VCF environment. As long as Aria Operations can reach the necessary vCenter/VCF components and other configured data sources, your usual infrastructure health, performance, capacity, alerts, symptoms, and internally collected metrics should continue to function as before.
The key issue is external security intelligence and product updates: air-gapping does not cause the environment to lose awareness of its own operational health, but Aria Operations will not have internet access and therefore cannot automatically retrieve anything that depends on an external service or current online content.
Regarding CVEs, do not use Aria Operations as the reliable source of vulnerability information in an isolated environment. Instead, you should follow a separate procedure to review Broadcom VMware Security Advisories (VMSAs), CVEs, release notes, and patches, then transfer the approved update packages into the air-gapped environment via your usual offline software-management process.
This is especially important now because Broadcom has issued security patches for Aria Operations itself; for instance, CVE-2026-22719 impacted Aria Operations versions 8.18.x up to and including 8.18.5 and was resolved in 8.18.6. Broadcom has also recently recorded additional CVEs, which were addressed in Aria Operations 8.18.7.
So I would think of the design as:
Air-gapped Aria Operations → local operational monitoring
External secured process → VMSA/CVE monitoring → approved offline patches → air-gapped environment
If your organization has no dedicated security staff, then ask a member of the infrastructure team to take responsibility for the external VMSA/CVE review process. Although air-gapping reduces exposure, it does not eliminate the need to track and patch vulnerabilities.
Hope this helps.