CVE-2026-41723
Description
VMware Cloud Foundation Operations has stored XSS flaws allowing privileged users to inject scripts and perform administrative actions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
VMware Cloud Foundation Operations has stored XSS flaws allowing privileged users to inject scripts and perform administrative actions.
Vulnerability
VMware Cloud Foundation Operations contains multiple stored cross-site scripting (XSS) vulnerabilities. These vulnerabilities affect versions prior to the patches released in VMSA-2026-0004. The specific flaw allows for script injection when creating policies, views, or text-widgets [1].
Exploitation
A malicious actor with privileges to create policies, views, or text-widgets can inject scripts into the VMware Cloud Foundation Operations interface. This requires the attacker to already possess administrative privileges within the affected system to create these specific components [1].
Impact
Successful exploitation allows an attacker to perform administrative actions within VMware Cloud Foundation Operations by injecting scripts. This could lead to unauthorized changes, data manipulation, or further compromise of the system, depending on the scripts injected [1].
Mitigation
Patches and updates are available to remediate these vulnerabilities. The specific fixed versions are detailed in the 'Response Matrix' within the advisory VMSA-2026-0004. No workarounds are available [1].
AI Insight generated on Jun 8, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.
References
1News mentions
1- Multiple VMware Stored XSS Vulnerabilities Allow Attackers to Inject Malicious ScriptsCyber Security News · Jun 8, 2026