Login Request a demo
Medium severity · published Jun 8, 2026
CVE-2026-41722
VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VO
VCF operations · VMware
9.1.x.x through 9.1.0.0; 9.0.x.x through 9.0.2.0 EP2; 5.x through 8.18.7 · source: vendor
VA
VMware Aria Operations · VMware
8.18.x through 8.18.6; 8.18.x through 8.18.7 · source: vendor
VT
VMware Telco Cloud Platform · VMware
5.x through 8.18.7 · source: vendor
AO
Aria Operations · Vmware
8.0 before 8.18.7 · source: NVD
CF
Cloud Foundation · Vmware
5.0 before 8.18.7; 9.0 before 9.0.2.0; 9.1 · source: NVD
TC
Telco Cloud Platform · Vmware
5.0 through 5.1 · source: NVD
VS
Vsphere · Vmware
9.0 before 9.0.2.0; 9.1 · source: NVD
Affected product
VO
VCF operations
VMware
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41722
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41722
Third Party Advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513
More from VCF operations
7.8
CVE-2025-41244
VMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)
8.0
CVE-2026-41723
VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)
5.4
CVE-2026-41724
VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)