Stored Cross-Site Scripting Vulnerability in VMware Aria Operations
CVE-2026-22720

8HIGH

Key Information:

Vendor

Vmware
Status
Vmware Aria Operations
Vmware Cloud Foundation
Vmware Telco Cloud Platform
Vmware Telco Cloud Infrastructure
Vendor
CVE Published:
25 February 2026

What is CVE-2026-22720?

VMware Aria Operations has a stored cross-site scripting vulnerability that can be exploited by a malicious actor with sufficient privileges to create custom benchmarks. This security flaw allows for the injection of malicious scripts that can perform unauthorized administrative actions within the platform. To enhance security, it is crucial to apply the recommended patches listed in the response matrix of VMSA-2026-0001.

Affected Version(s)

VMware Aria Operations 8.18.0

VMware Aria Operations 8.18.0 < 8.18.6

VMware Cloud Foundation 4.0

References

https://support.broadcom.com/web/ecx/support-content-noti...
vendor-advisory
https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-...
release-notes

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.