What is the CVSS score of CVE-2026-41722?

CVE-2026-41722 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of VMware Cloud Foundation Operations are affected by CVE-2026-41722?

VMware Cloud Foundation Operations contains a stored scripting vulnerability (CVSS 8.0) that allows privileged system users to inject malicious content targeting administrators and other users across…

How to fix or mitigate CVE-2026-41722?

Within 24 hours: Identify all deployments of VCF Operations 9.x, Aria Operations 8.18.x, and Telco Cloud Platform 5.x; audit which users hold policy, view, or text-widget creation privileges. Within 7 days: Restrict these creation privileges to only essential personnel; implement network-level monitoring for suspicious policy and widget modifications. Within 30 days: Monitor VMware security advisories for patch release; develop an upgrade plan to patched versions when vendor releases fix.

VMware Cloud Foundation Operations CVE-2026-41722

EUVD-2026-35030 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-08 vmware

GHSA-3q9r-4xf6-m724

XSS VMware Vcf Operations Vmware Aria Operations Vmware Telco Cloud Platform

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jun 16, 2026 - 13:52 NVD

HIGH MEDIUM

CVSS changed

Jun 16, 2026 - 13:52 NVD

8.0 (HIGH) 5.4 (MEDIUM)

Analysis Generated

Jun 08, 2026 - 10:35 vuln.today

CVE Published

Jun 08, 2026 - 07:05 nvd

HIGH 8.0

DescriptionNVD

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

Articles & Coverage 1

News 3 New VMware Vulnerabilities - 3 High Severity Patched Jun 09, 2026

AnalysisAI

Stored cross-site scripting in VMware Cloud Foundation Operations (formerly VMware Aria Operations) allows authenticated users with policy, view, or text-widget creation privileges to inject scripts that execute in the browser context of other users, including administrators. The flaw spans VCF Operations 9.x, the legacy 5.x/Aria Operations 8.18.x line, and VMware Telco Cloud Platform 5.x, with a CVSS of 8.0 driven by high impact across confidentiality, integrity, and availability when a victim admin renders the malicious content. No public exploit identified at time of analysis and no EPSS or KEV signal is provided in the input.

Technical ContextAI

VMware Cloud Foundation Operations is the rebranded VMware Aria Operations platform used for capacity, performance, cost, and configuration management across vSphere/VCF estates and, via Telco Cloud Platform, telco NFV deployments. The vulnerability sits in user-authorable content surfaces - policy definitions, custom views, and text/dashboard widgets - where input is stored server-side and later rendered in the management UI without adequate output encoding or script sanitization. This is a classic stored XSS pattern (CWE-79 class, though CWE is N/A in the input) where the persistence layer trusts privileged authors and the rendering layer fails to neutralize HTML/JS, letting attacker-controlled markup execute under the session of any user who later views the policy, view, or dashboard widget.

RemediationAI

Patch available per vendor advisory - consult Broadcom advisory 37513 at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513 for the exact fixed builds applicable to your VCF Operations 9.1.x, 9.0.x, 5.x/Aria 8.18.x, or Telco Cloud Platform 5.x deployment, as the input data does not enumerate a single canonical fixed version string. Until patched, tighten role assignments so that only fully trusted operators hold the policy-creation, view-creation, and text-widget-creation privileges, and audit existing custom policies, views, and dashboards for unexpected HTML or script content in titles, descriptions, and widget bodies (side effect: legitimate dashboard authors will need elevated change-control). Additionally, restrict network access to the Operations UI to a management VLAN or jump-host so a compromised low-privilege account cannot pivot to the admin console from arbitrary networks, and encourage administrators to avoid opening unfamiliar custom views until upgrade is complete.