CVE-2026-41722: VMware Aria Operations

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

Affected products

• VMware Aria Operations: from 8.0, before 8.18.7 (fixed in 8.18.7)
• VMware Cloud Foundation: from 5.0, before 8.18.7 (fixed in 8.18.7); from 9.0, before 9.0.2.0 (fixed in 9.0.2.0); version 9.1 only
• VMware Telco Cloud Platform: from 5.0, up to and including 5.1
• VMware Vsphere: from 9.0, before 9.0.2.0 (fixed in 9.0.2.0); version 9.1 only

Published 2026-06-08. Last modified 2026-07-23.