This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] VMware fixes 3 vulnerabilities in its products
VMware fixes 3 vulnerabilities in its products that contain the VMware Cloud Foundation Operations and VMware Aria Operations components [1]. For VMware Telco Cloud Platform, follow KB443138 [2]. Products and their fixed versions [1]: VMware Cloud Foundation - 9.1.0.0, 9.0.2.0 EP2, 8.18.7, VMware vSphere Foundation - 9.1.0.0, 9.0.2.0 EP2, VMware Aria Operations - 8.18.7.
An authenticated remote attacker with permissions to create policies, views or text widgets can inject arbitrary scripts through multiple stored cross-site scripting (XSS) vulnerabilities and use them to perform administrative actions [1].
The vulnerability is present in products:
- VMware Cloud Foundation; >=9.1, <9.1.0.0; >=9.0, <9.0.2.0 EP2; >=5.0, <8.18.7
- VMware vSphere Foundation; >=9.1, <9.1.0.0; >=9.0, <9.0.2.0 EP2
- VMware Aria Operations; >=8.0, <8.18.7
- VMware Telco Cloud Platform;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-41722 at cve.org, NVD
- CVE-2026-41723 at cve.org, NVD
- CVE-2026-41724 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) at cwe.mitre.org
The vulnerability was publicly disclosed 8. 6. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 9. 6. 2026.