CVE-2026-41722

published 2026-06-08

CVE-2026-41722: VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or…

Priority P4 28 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
vmware	aria_operations	>= 8.0 < 8.18.7	8.18.7
vmware	cloud_foundation	—	—
vmware	cloud_foundation	>= 5.0 < 8.18.7	8.18.7
vmware	cloud_foundation	>= 9.0 < 9.0.2.0	9.0.2.0
vmware	telco_cloud_platform	5.0 – 5.1	—
vmware	vcf_operations	5.x – 8.18.7	—
vmware	vmware_aria_operations	8.18.x – 8.18.7	—
vmware	vmware_telco_cloud_platform	5.x – 8.18.7	—
vmware	vsphere	—	—
vmware	vsphere	>= 9.0 < 9.0.2.0	9.0.2.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79