← Back

CVE-2026-22720

nvd nist
Published: Feb 25, 2026Modified: Jun 17, 2026

JSON object

Loading...
9.0
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Exploitability: 2.3 / Impact: 6.0
Source: NVD

Description

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations.  To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of  VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// .

Affected (5)

Vmware
4 products
Aria Operations
Cloud Foundation
Telco Cloud Infrastructure
Telco Cloud Platform
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Aria Operations
From 8.0 to 8.18.6
Vmware
Cloud Foundation
From 4.0 to 5.2.3
Cloud Foundation
From 9.0 to 9.0.2.0
Telco Cloud Infrastructure
From 2.2 to 3.0
Telco Cloud Platform
From 4.0 to 5.1

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

Source: security@vmware.com
PatchVendor Advisory
Source: security@vmware.com
Release Notes

Timeline

No history available yet.