CVE-2026-41722: VMware Cloud Foundation Operations multiple stored XSS

CVE-2026-41722 · Severity: high · CVSS 8 · Published 2026-06-08

VMware Cloud Foundation Operations, a platform used for managing and monitoring hybrid cloud environments, is affected by multiple security flaws. A malicious user with basic permissions to create dashboard elements like policies or text widgets can inject malicious scripts into the system. If an administrator views these elements, the attacker could potentially perform unauthorized administrative actions, leading to a full takeover of the management console.

Technologies: VMware Cloud Foundation, VMware Cloud Foundation Operations, VMware vSphere Foundation. Vendors: VMware.

Quick answers

Is CVE-2026-41722 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41722 being exploited in the wild.
How severe is CVE-2026-41722?
High severity, with a CVSS score of 8, published 8 June 2026.
Which products and versions are affected?
VMware Cloud Foundation 9.1.x.x, 9.0.x.x; VMware Cloud Foundation Operations 9.1.x.x, 9.0.x.x; VMware vSphere Foundation 9.1.x.x, 9.0.x.x.
Is there a fix for CVE-2026-41722?
A patch was published on 2026-06-08: Patches made available across multiple product lines Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41722 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41722?
Check whether you run VMware Cloud Foundation, VMware Cloud Foundation Operations or VMware vSphere Foundation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

VMware Cloud Foundation Operations (formerly Aria Operations) contains multiple stored cross-site scripting (XSS) vulnerabilities. The root cause is improper sanitization of user-supplied input within the components responsible for creating policies, views, or text-widgets. An attacker with low-privileged access (PR:L) can inject malicious JavaScript that executes in the context of other users, including administrators, when they interact with the affected UI elements (UI:R). Successful exploitation allows the attacker to perform administrative actions, potentially leading to full compromise of the application. Patches have been released for affected versions including 9.1.0.0, 9.0.2.0 EP2, and 8.18.7.

Affected products

  • VMware Cloud Foundation Operations 9.1.x.x, 9.0.x.x
  • VMware Aria Operations 8.x, 5.x
  • VMware Cloud Foundation 9.1.x.x, 9.0.x.x, 5.x
  • VMware vSphere Foundation 9.1.x.x, 9.0.x.x
  • VMware Telco Cloud Platform 5.x

Timeline

  • 2026-06-08: disclosed: Initial advisory publication by Broadcom/VMware
  • 2026-06-08: patched: Patches made available across multiple product lines

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.