This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] VMware fixes 3 vulnerabilities in its products

VMware fixes 3 vulnerabilities in its products that include the VMware Aria Operations component [1]. For VMware Telco Cloud Platform and VMware Telco Cloud Infrastructure, follow KB428241 [2]. Products and their fixed versions [1]: VMware Cloud Foundation - 9.0.2.0, 5.2.3, VMware vSphere Foundation - 9.0.2.0, VMware Aria Operations - 8.18.6.

VMware Aria Operations - RCE (CVE-2026-22719)
CVSS 8.1 (High)

Due to insufficient input handling in VMware Aria Operations, an unauthenticated remote attacker can execute code. This vulnerability is exploitable only during an active product migration process in the support-assisted mode [1].

The vulnerability is present in products:

  • VMware Aria Operations; >=8.0, <8.18.6
  • VMware Cloud Foundation; >=9.0, <9.0.2.0
  • VMware Cloud Foundation; >=4.0, <5.2.3
  • VMware vSphere Foundation; >=8.0, <8.18.6
  • VMware Telco Cloud Platform;
  • VMware Telco Cloud Infrastructure;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-22719 at cve.org, NVD
  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 24. 2. 2026.

VMware Aria Operations - XSS (CVE-2026-22720)
CVSS 7.3 (High)

An authenticated remote attacker with the permission to create custom benchmarks can carry out a stored XSS attack, which may lead to administrator actions being performed in the victim's context [1].

The vulnerability is present in products:

  • VMware Aria Operations; >=8.0, <8.18.6
  • VMware Cloud Foundation; >=9.0, <9.0.2.0
  • VMware Cloud Foundation; >=4.0, <5.2.3
  • VMware vSphere Foundation; >=8.0, <8.18.6
  • VMware Telco Cloud Platform;
  • VMware Telco Cloud Infrastructure;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

More information:

  • CVE-2026-22720 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 24. 2. 2026.

VMware Aria Operations - privilege escalation (CVE-2026-22721)
CVSS 6.2 (Medium)

An authenticated remote attacker with vCenter privileges that grant access to VMware Aria Operations can escalate privileges up to the administrator level [1].

The vulnerability is present in products:

  • VMware Aria Operations; >=8.0, <8.18.6
  • VMware Cloud Foundation; >=9.0, <9.0.2.0
  • VMware Cloud Foundation; >=4.0, <5.2.3
  • VMware vSphere Foundation; >=8.0, <8.18.6
  • VMware Telco Cloud Platform;
  • VMware Telco Cloud Infrastructure;

CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

More information:

The vulnerability was publicly disclosed 24. 2. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 4. 3. 2026.

CESNET, z.s.p.o. Logo