CVE-2026-41724

Published: Jun 8, 2026Modified: Jul 23, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

Affected (3)

Products: Vmware: Aria Operations, Cloud Foundation, Telco Cloud Platform

3 products

Aria Operations

Cloud Foundation

Telco Cloud Platform

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Vmware Aria Operations	From 8.0 to 8.18.7
Vmware Cloud Foundation	From 5.0 to 8.18.7
Vmware Telco Cloud Platform	From 5.0 to 8.18.7

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513

Source: security@vmware.com

Third Party Advisory

Timeline

No history available yet.