What is the CVSS score of CVE-2026-41723?

CVE-2026-41723 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of VMware Cloud Foundation Operations are affected by CVE-2026-41723?

VMware Cloud Foundation Operations and Aria Operations (versions 5.x-9.1.x) contain a stored cross-site scripting vulnerability (CVSS 8.0) that allows authenticated users with administrative or…

How to fix or mitigate CVE-2026-41723?

Within 24 hours: Audit and document all accounts with policy, view, and text-widget creation privileges; immediately restrict these permissions to essential administrative accounts. Within 7 days: Implement input validation and output encoding on widget and policy creation functions; deploy Web Application Firewall rules to block script injection patterns. Within 30 days: Monitor VMware security advisories for patch availability; plan and test upgrade path to patched versions when released.

VMware Cloud Foundation Operations CVE-2026-41723

EUVD-2026-35031 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-08 vmware

GHSA-wfp8-3hcq-xm45

XSS VMware Vcf Operations Vmware Aria Operations Vmware Telco Cloud Platform

8.0

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:34 vuln.today

CVE Published

Jun 08, 2026 - 07:06 nvd

HIGH 8.0

DescriptionCVE.org

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

Articles & Coverage 1

News 3 New VMware Vulnerabilities - 3 High Severity Patched Jun 09, 2026

AnalysisAI

Stored cross-site scripting in VMware Cloud Foundation Operations (formerly Aria Operations) allows authenticated users with policy, view, or text-widget creation privileges to inject malicious scripts that execute in other users' browsers, including administrators. Affected products include VCF Operations 5.x through 9.1.x, VMware Aria Operations 8.18.x, and VMware Telco Cloud Platform 5.x. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in VMware Cloud Foundation Operations (Broadcom's rebrand of VMware Aria Operations), a multi-cloud IT operations management platform used for monitoring, capacity, performance, and compliance across vSphere and hybrid clouds. The flaw is a stored XSS where user-supplied input in policy definitions, custom views, and text widgets is persisted and rendered without sufficient output encoding or sanitization, falling under CWE-79 (Improper Neutralization of Input During Web Page Generation). Because these objects are typically shared across operators in the management UI, injected payloads execute in the context of any user who views them, including privileged administrators. The affected CPEs span vmware:vcf_operations, vmware:vmware_aria_operations, and vmware:vmware_telco_cloud_platform, indicating the shared codebase is reused across the Aria/VCF Operations product line and the Telco Cloud Platform.

RemediationAI

Patch available per vendor advisory - consult Broadcom Security Advisory 37513 at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513 for the exact fixed builds applicable to your deployment (VCF Operations 5.x/9.0.x/9.1.x, Aria Operations 8.18.x, and Telco Cloud Platform 5.x). Until patches are applied, restrict the roles able to create or edit policies, custom views, and text widgets to a minimal set of trusted administrators, and audit existing policies, views, and text widgets for unexpected HTML or script content; note that tightening these permissions will block legitimate operator self-service of dashboards and policy authoring. As a network-layer compensating control, limit access to the Operations web UI to a management VLAN or bastion to reduce exposure of authenticated sessions to attacker-controlled browsers, accepting the operational cost of removing direct UI access for distributed teams.