EUVD-2026-35031
GHSA-wfp8-3hcq-xm45
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (vmware) · only source for this CVE.
CVSS VectorVendor: vmware
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in VMware Cloud Foundation Operations (formerly Aria Operations) allows authenticated users with policy, view, or text-widget creation privileges to inject malicious scripts that execute in other users' browsers, including administrators. Affected products include VCF Operations 5.x through 9.1.x, VMware Aria Operations 8.18.x, and VMware Telco Cloud Platform 5.x. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must hold an authenticated account on VMware Cloud Foundation Operations (or Aria Operations / Telco Cloud Platform) with privileges to create or modify policies, custom views, or text widgets - these are not default unauthenticated endpoints. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable attack with low complexity but requiring low-privileged authentication and user interaction - typical of a stored XSS where the victim must view the malicious object. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged operator account - obtained via phishing, credential reuse, or insider access - is used to create a custom view, policy, or text widget containing a malicious JavaScript payload. When an administrator subsequently opens that object in the Operations UI, the script executes in the admin's authenticated session and silently issues API calls to modify policies, create accounts, or alter monitored infrastructure configurations. … |
| Remediation | Patch available per vendor advisory - consult Broadcom Security Advisory 37513 at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513 for the exact fixed builds applicable to your deployment (VCF Operations 5.x/9.0.x/9.1.x, Aria Operations 8.18.x, and Telco Cloud Platform 5.x). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit and document all accounts with policy, view, and text-widget creation privileges; immediately restrict these permissions to essential administrative accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today