Stored Cross-Site Scripting Vulnerability in VMware Aria Operations
CVE-2026-22720

8HIGH

Key Information:

Vendor

Vmware
Status
Vmware Aria Operations
Vmware Cloud Foundation
Vmware Telco Cloud Platform
Vmware Telco Cloud Infrastructure
Vendor
CVE Published:
25 February 2026

What is CVE-2026-22720?

VMware Aria Operations has a stored cross-site scripting vulnerability that can be exploited by a malicious actor with sufficient privileges to create custom benchmarks. This security flaw allows for the injection of malicious scripts that can perform unauthorized administrative actions within the platform. To enhance security, it is crucial to apply the recommended patches listed in the response matrix of VMSA-2026-0001.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

VMware Aria Operations 8.18.0

VMware Aria Operations 8.18.0 < 8.18.6

VMware Cloud Foundation 4.0

References

https://support.broadcom.com/web/ecx/support-content-noti...
vendor-advisory
https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-...
release-notes

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.