CVE-2026-41724: VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-08 · updated 2026-07-23
Weakness: CWE-79

Description

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

Affected products

VMware Aria Operations: from 8.0 before 8.18.7 — fixed in 8.18.7
VMware Cloud Foundation: from 5.0 before 8.18.7 — fixed in 8.18.7
VMware Telco Cloud Platform: from 5.0 before 8.18.7 — fixed in 8.18.7
VMware Aria Operations: from 8.18.x through 8.18.7
VMware Telco Cloud Platform: from 5.x through 8.18.7
VMware VCF operations: from 5.x through 8.18.7

How to fix

Upgrade to a fixed version: VMware Aria Operations 8.18.7; VMware Cloud Foundation 8.18.7; VMware Telco Cloud Platform 8.18.7. Check the vendor advisory for mitigations.

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513

Get alerted when CVE-2026-41724 or the next vulnerability affects your stack