CVE-2026-41724
published 2026-06-08CVE-2026-41724: VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or…
PriorityP428medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.31%
23.2th percentile
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | aria_operations | >= 8.0 < 8.18.7 | 8.18.7 |
| vmware | cloud_foundation | >= 5.0 < 8.18.7 | 8.18.7 |
| vmware | telco_cloud_platform | >= 5.0 < 8.18.7 | 8.18.7 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
VMware VCF operations up to 8.18.7 cross site scripting
vuldb·2026-06-15·CVSS 5.4
CVE-2026-41724 [MEDIUM] VMware VCF operations up to 8.18.7 cross site scripting
A vulnerability was found in VMware VCF operations, Aria Operations and Telco Cloud Platform up to 8.18.7. It has been declared as problematic. Affected by this issue is some unknown functionality. Executing a manipulation can lead to cross site scripting.
This vulnerability is tracked as CVE-2026-41724. The attack can be launched remotely. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scrip
ghsa_unreviewed·2026-06-08
CVE-2026-41724 [HIGH] CWE-79 VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scrip
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
No detection rules found.
No public exploits indexed.
2026-06-08
Published