Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2026-22720

VMware Aria Operations stored cross-site scripting vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations.  To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of  VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// .

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

VMware VMware Aria Operations

Default version status: affected

  • 8.18.0 to < 8.18.6affected
  • 8.18.6unaffected

VMware VMware Cloud Foundation Operations

Default version status: affected

  • 4.x to < 5.2.3affected
  • 9.x.x to < 9.0.2affected
  • 5.x to < 5.2.3unaffected

VMware VMware Telco Cloud Platform

Default version status: affected

  • 4.0 to < 5.2.3affected
  • 5.2.3unaffected

VMware VMware Telco Cloud Infrastructure

Default version status: affected

  • 2.0 to < 5.2.3affected
  • 5.2.3unaffected

References