Riskcovery

CVE-2026-41723

VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)

State
Published
Severity
8.0 High
Published
Jun 8, 2026
Updated
Jun 9, 2026
Reserved
Apr 22, 2026

Read the record on cve.org

Description

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

Scores

CVSSScoreVectorSource
3.18.0 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:Hvmware

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
VCF operationsVMware
  • 9.1.x.x through 9.1.0.0Affected
  • 9.0.x.x through 9.0.2.0 EP2Affected
  • 5.x through 8.18.7Affected
VMware Aria OperationsVMware
  • 8.18.x through 8.18.6Affected
  • 8.18.x through 8.18.7Affected
VMware Telco Cloud PlatformVMware
  • 5.x through 8.18.7Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.