← Back

CVE-2026-41722

nvd nist
Published: Jun 8, 2026Modified: Jul 23, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.3 / Impact: 2.7
Source: NVD

Description

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

Affected (7)

Vmware
4 products
Aria Operations
Cloud Foundation
Telco Cloud Platform
Vsphere
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Aria Operations
From 8.0 to 8.18.7
Vmware
Cloud Foundation
From 5.0 to 8.18.7
Cloud Foundation
From 9.0 to 9.0.2.0
Cloud Foundation
Version 9.1
Telco Cloud Platform
From 5.0 to 5.1
Vmware
Vsphere
From 9.0 to 9.0.2.0
Vsphere
Version 9.1

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

Source: security@vmware.com
Third Party Advisory

Timeline

No history available yet.