# CVE-2026-41723: VMware Cloud Foundation Operations stored XSS in policies and widgets

Source: https://junglewise.ai/threats/cve-2026-41723-vmware-cloud-foundation-operations-stored-xss-in-policies-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-41723 · Severity: high · CVSS 8 · Published 2026-06-08

VMware Cloud Foundation Operations, a platform used for managing and monitoring hybrid cloud infrastructure, is affected by security vulnerabilities that allow malicious scripts to be saved within the system. An attacker with basic user permissions could use these scripts to trick administrators into performing unauthorized actions. This could lead to a full takeover of the management console, potentially disrupting cloud operations or exposing sensitive configuration data.

Technologies: [VMware Cloud Foundation Operations](https://junglewise.ai/threats/technologies/cloud-foundation-operations), [VMware vSphere Foundation](https://junglewise.ai/threats/technologies/vsphere-foundation). Vendors: [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41723 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41723 being exploited in the wild.

**How severe is CVE-2026-41723?** High severity, with a CVSS score of 8, published 8 June 2026.

**Which products and versions are affected?** VMware Cloud Foundation Operations 9.1.x.x, 9.0.x.x; VMware vSphere Foundation 9.1.x.x, 9.0.x.x.

**Is there a fix for CVE-2026-41723?** A patch was published on 2026-06-08: Fixed versions released across multiple product lines Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41723 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41723?** Check whether you run VMware Cloud Foundation Operations or VMware vSphere Foundation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

VMware Cloud Foundation Operations (formerly Aria Operations) contains multiple stored cross-site scripting (XSS) vulnerabilities. The flaw exists because the application fails to properly sanitize user-supplied input when creating policies, views, or text-widgets. An authenticated attacker with low-level privileges can inject malicious JavaScript that executes in the context of other users, including administrators, when they view the affected components. Successful exploitation requires a victim to interact with the malicious content and can result in the attacker performing administrative actions or hijacking sessions. Patches are available in versions 9.1.0.0, 9.0.2.0 EP2, and 8.18.7 depending on the specific product line.

## Affected products

- VMware Cloud Foundation Operations 9.1.x.x, 9.0.x.x
- VMware Aria Operations 8.x, 5.x
- VMware vSphere Foundation 9.1.x.x, 9.0.x.x
- VMware Telco Cloud Platform 5.x

## Timeline

- 2026-06-08: disclosed: Initial advisory publication by Broadcom/VMware
- 2026-06-08: patched: Fixed versions released across multiple product lines

## References

- [https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513)

## Related threats

- [VMware ESX insufficient logging vulnerability](https://junglewise.ai/threats/cve-2026-41709-vmware-esx-insufficient-logging-vulnerability)
- [VMware vCenter directory traversal in Syslog server](https://junglewise.ai/threats/cve-2026-59310-vmware-vcenter-directory-traversal-in-syslog-server)
- [VMware vCenter authentication bypass in VMware Directory Service](https://junglewise.ai/threats/cve-2026-59309-vmware-vcenter-authentication-bypass-in-vmware-directory-service)
- [VMware ESX out-of-bounds write in VMXNET3 adapter](https://junglewise.ai/threats/cve-2026-47876-vmware-esx-out-of-bounds-write-in-vmxnet3-adapter)
- [VMware Cloud Foundation Operations stored XSS in policies and widgets](https://junglewise.ai/threats/cve-2026-41724-vmware-cloud-foundation-operations-stored-xss-in-policies-and)