CVE-2026-41722

Vulnerability

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities. These vulnerabilities are present in versions prior to the application of patches. A malicious actor with privileges to create policies, views, or text-widgets can exploit this flaw [1].

Exploitation

An attacker requires privileges to create policies, views, or text-widgets within VMware Cloud Foundation Operations. Once authenticated with these privileges, the attacker can inject malicious scripts into these components, which are then executed when other users interact with them [1].

Impact

Successful exploitation allows an attacker to inject scripts that can perform administrative actions within VMware Cloud Foundation Operations. This could lead to unauthorized modifications, data manipulation, or further compromise of the system, depending on the injected script's functionality [1].

Mitigation

Patches and updates are available to remediate these vulnerabilities. Users should apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' in the advisory. No workarounds are available [1].