CVE-2026-22720

VMware Aria Operations stored cross-site scripting vulnerability

State: Published
Severity: 8.0 High
Published: Feb 25, 2026
Updated: Apr 14, 2026
Reserved: Jan 9, 2026

Description

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations.

To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// .

Scores

CVSS	Score	Vector	Source
3.1	8.0 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	vmware

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
VMware Aria OperationsVMware	8.18.0 to before 8.18.6Affected 8.18.6Not affected
VMware Cloud Foundation OperationsVMware	4.x to before 5.2.3Affected 9.x.x to before 9.0.2Affected 5.x to before 5.2.3Not affected
VMware Telco Cloud PlatformVMware	4.0 to before 5.2.3Affected 5.2.3Not affected
VMware Telco Cloud InfrastructureVMware	2.0 to before 5.2.3Affected 5.2.3Not affected

References

VMSA-2026-0001: VMware Aria Operations updates (includes CVE-2026-22720)vendor-advisory
VMware Aria Operations 8.18.6 Release Notes (resolves CVE-2026-22720)release-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.