CVE-2026-41724

Vulnerability

VMware Cloud Foundation Operations contains multiple stored cross-site scripting (XSS) vulnerabilities. These issues affect versions prior to the patches detailed in the response matrix [1].

Exploitation

A malicious actor with privileges to create policies, views, or text-widgets can inject scripts into these components. This script injection can then be used to perform administrative actions within VMware Cloud Foundation Operations [1].

Impact

Successful exploitation allows an attacker to perform administrative actions, potentially leading to unauthorized changes or compromise of the system's administrative functions. The scope of the compromise is limited to the administrative capabilities accessible through the affected components [1].

Mitigation

Patches and updates are available to remediate these vulnerabilities. Customers should apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' provided in the advisory [1]. No workarounds are available. The advisory was initially published on 2026-06-08 [1].