CVE-2026-41723: VMware Cloud Foundation Operations stored XSS in policies and widgets

CVE-2026-41723 · Severity: high · CVSS 8 · Published 2026-06-08

VMware Cloud Foundation Operations, a platform used for managing and monitoring hybrid cloud infrastructure, is affected by security vulnerabilities that allow malicious scripts to be saved within the system. An attacker with basic user permissions could use these scripts to trick administrators into performing unauthorized actions. This could lead to a full takeover of the management console, potentially disrupting cloud operations or exposing sensitive configuration data.

Technologies: VMware Cloud Foundation Operations, VMware vSphere Foundation. Vendors: VMware.

Quick answers

Is CVE-2026-41723 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41723 being exploited in the wild.
How severe is CVE-2026-41723?
High severity, with a CVSS score of 8, published 8 June 2026.
Which products and versions are affected?
VMware Cloud Foundation Operations 9.1.x.x, 9.0.x.x; VMware vSphere Foundation 9.1.x.x, 9.0.x.x.
Is there a fix for CVE-2026-41723?
A patch was published on 2026-06-08: Fixed versions released across multiple product lines Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41723 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41723?
Check whether you run VMware Cloud Foundation Operations or VMware vSphere Foundation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

VMware Cloud Foundation Operations (formerly Aria Operations) contains multiple stored cross-site scripting (XSS) vulnerabilities. The flaw exists because the application fails to properly sanitize user-supplied input when creating policies, views, or text-widgets. An authenticated attacker with low-level privileges can inject malicious JavaScript that executes in the context of other users, including administrators, when they view the affected components. Successful exploitation requires a victim to interact with the malicious content and can result in the attacker performing administrative actions or hijacking sessions. Patches are available in versions 9.1.0.0, 9.0.2.0 EP2, and 8.18.7 depending on the specific product line.

Affected products

  • VMware Cloud Foundation Operations 9.1.x.x, 9.0.x.x
  • VMware Aria Operations 8.x, 5.x
  • VMware vSphere Foundation 9.1.x.x, 9.0.x.x
  • VMware Telco Cloud Platform 5.x

Timeline

  • 2026-06-08: disclosed: Initial advisory publication by Broadcom/VMware
  • 2026-06-08: patched: Fixed versions released across multiple product lines

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.