CVE-2026-41723: VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or…

PriorityP340high8CVSS 3.1

AVNACLPRLUIRSUCHIHAH

EPSS

0.40%

32.0th percentile

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
vmware	aria_operations	>= 8.0 < 8.18.7	8.18.7
vmware	cloud_foundation	—	—
vmware	cloud_foundation	>= 5.0 < 8.18.7	8.18.7
vmware	cloud_foundation	>= 9.0 < 9.0.2.0	9.0.2.0
vmware	telco_cloud_platform	5.0 – 5.1	—
vmware	vsphere	—	—
vmware	vsphere	>= 9.0 < 9.0.2.0	9.0.2.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.