CVE-2026-41724: VMware Aria Operations

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

Affected products

• VMware Aria Operations: from 8.0, before 8.18.7 (fixed in 8.18.7)
• VMware Cloud Foundation: from 5.0, before 8.18.7 (fixed in 8.18.7)
• VMware Telco Cloud Platform: from 5.0, before 8.18.7 (fixed in 8.18.7)

Published 2026-06-08. Last modified 2026-07-23.