EUVD-2026-35032
GHSA-76rr-q8xf-r868
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionNVD
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in VMware Cloud Foundation Operations (and the related Aria Operations / Telco Cloud Platform builds) lets an authenticated user who can create policies, views, or text-widgets inject script that executes in the browser of any user who later views the affected object, including administrators. Because the CVSS vector marks Confidentiality, Integrity, and Availability as High with Scope:Unchanged, a successful payload effectively lets a low-privileged operator escalate to administrative actions inside the Operations console. No public exploit identified at time of analysis and not currently listed in CISA KEV, but a vendor advisory has been issued by Broadcom.
Technical ContextAI
The affected component is VMware Cloud Foundation Operations, formerly marketed as VMware Aria Operations and also shipped inside the VMware Telco Cloud Platform stack - the CPE strings cpe:2.3:a:vmware:vcf_operations, vmware_aria_operations, and vmware_telco_cloud_platform all reference the same monitoring/analytics product line. The flaw class is stored cross-site scripting (corresponding to CWE-79, Improper Neutralization of Input During Web Page Generation), realized in three user-content surfaces of the product UI: policy definitions, custom views, and text-widget dashboard components. Because these objects are persisted server-side and rendered to every user with access to them, injected JavaScript runs under the session and origin of any later viewer, including operators with administrative roles, enabling forced-browsing of privileged API endpoints from the victim's authenticated context.
RemediationAI
Apply the fixed build referenced in the Broadcom advisory at https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513 - the input data does not include an exact post-8.18.7 fix version, so consult that advisory for the precise patched release for each SKU (VCF Operations, Aria Operations, Telco Cloud Platform) before upgrading. Until the patch is deployed, restrict the 'create/modify policy', 'create/modify view', and 'create/edit text-widget' permissions to a minimal set of trusted operators via role-based access control, since the exploit requires those specific authoring privileges; this reduces who can plant a payload but does not protect viewing administrators if a malicious or compromised author exists. Additionally, audit existing custom policies, views, and dashboard text-widgets for unexpected <script>, on*= handlers, or javascript: URIs before re-enabling broad authoring rights, and consider enforcing a strict Content-Security-Policy at any reverse proxy fronting the Operations UI as a compensating control - note this may break legitimate dashboard widgets that rely on inline script and should be tested in a staging tenant first.
More in Vcf Operations
View allStored cross-site scripting in VMware Cloud Foundation Operations (formerly Aria Operations) allows authenticated users
Stored cross-site scripting in VMware Cloud Foundation Operations (formerly VMware Aria Operations) allows authenticated
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today