CVE-2026-22720 — Cross-site Scripting in Vmware Aria Operations

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
9.0CRITICALNVD
EPSS
0.1%
top 71.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Vmware Aria OperationsVmware Cloud Foundation OperationsVmware Telco Cloud Infrastructure+5 more
Timeline
PublishedFeb 25

Description

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// .

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HExploitability: 2.3 | Impact: 6.0

Affected Packages8 packages

▶NVDvmware/aria_operations8.0 — 8.18.6
▶CVEListV5vmware/vmware_aria_operations8.18.0 — 8.18.6
▶NVDvmware/cloud_foundation4.0 — 5.2.3+1
▶CVEListV5vmware/vmware_telco_cloud_platform4.0 — 5.2.3

Patches

Patch: support.broadcom.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-rr3q-q2xp-f894: VMware Aria Operations contains a stored cross-site scripting vulnerability↗2026-02-25
▶
CVEList
VMware Aria Operations stored cross-site scripting vulnerability↗2026-02-25
▶
CVE-2026-22720 — Cross-site Scripting in Vmware | cvebase