VMware Cloud Foundation Operations CVE-2026-41722: Overview of Stored XSS Enabling Administrative Takeover

Introduction

Three stored cross-site scripting vulnerabilities were disclosed at the same time in VMware Cloud Foundation Operations, and together they reveal a systemic input sanitization failure in one of the most widely deployed enterprise virtualization management platforms. CVE-2026-41722, the lead CVE in advisory VMSA-2026-0004, lets an authenticated user with relatively modest privileges plant persistent JavaScript payloads that execute whenever an administrator views the compromised resource. In practice, that is privilege escalation to full administrative control of the management plane.

This disclosure arrives just four months after CVE-2026-22719, a command injection flaw in the same product line, was confirmed as actively exploited in the wild and added to the CISA Known Exploited Vulnerabilities catalog. Adversaries have already shown interest in VMware Aria/VCF Operations, and stored XSS keeps recurring in it (this is the third round in 18 months). Together, those two facts make CVE-2026-41722 a priority for any organization running this management stack.

Technical Information

Root Cause: Insufficient Input Sanitization in Configurable UI Elements

CVE-2026-41722 is a stored cross-site scripting vulnerability classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) per the NVD entry. VMware Cloud Foundation Operations does not adequately sanitize user-supplied input when users create or modify policies, views, or text-widgets in the management interface. These configurable UI surfaces accept user content and render it back to other users, including administrators, without properly encoding or escaping embedded script content.

The CVSSv3.1 base score is 8.0 with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. The vector breaks down as follows:

Attack Flow

Based on the advisory details and the vulnerability's characteristics, exploitation proceeds as follows:

1. Initial Access: The attacker authenticates to VMware Cloud Foundation Operations with a low-privilege account that has permission to create policies, views, or text-widgets. This could be a legitimate insider, a compromised service account, or an account obtained through credential theft.

2. Payload Injection: The attacker crafts a policy, view, or text-widget containing malicious JavaScript. The application does not sanitize the input, so the script is stored persistently in the backend.

3. Trigger via User Interaction: When an administrator (or any other user with higher privileges) opens the page that displays the attacker's policy, view, or text-widget, the stored JavaScript executes in the administrator's browser session.

4. Administrative Action Execution: The injected script runs with the full privileges of the viewing administrator's session. The attacker can then perform arbitrary administrative actions in VCF Operations, including changing configurations, accessing sensitive data, creating new administrative accounts, or disrupting service availability.

Persistence is what makes stored XSS more dangerous here than a reflected XSS variant would be. The payload stays active until someone explicitly removes it, so it can fire against multiple administrators over an extended period with no further action from the attacker.

Batch Disclosure: Three Related CVEs

VMSA-2026-0004 covers three stored XSS vulnerabilities, each with a CVSS score of 8.0:

• CVE-2026-41722
• CVE-2026-41723
• CVE-2026-41724

Three separate CVEs for what appears to be the same vulnerability class, spread across different UI surfaces, suggests that the input sanitization failure reaches beyond a single code path, and that multiple independently developed UI components share the same lack of output encoding or input validation.

Systemic Pattern Across Advisory Cycles

Stored XSS has turned up in this product line before:

Each advisory cycle fixes a different set of configurable UI elements, but the vulnerability class stays the same. That pattern indicates Broadcom has been patching individual injection points instead of implementing a framework-level fix, such as automatic output encoding for all rendered user content.

Affected Systems and Versions

The Broadcom advisory (VMSA-2026-0004) lists these affected products and versions:

Organizations running VMware Aria Operations should target version 8.18.7 specifically, because version 8.18.6 fixes only two of the three CVEs in this advisory. For VCF and vSphere Foundation deployments, the fixed versions are 9.1.0.0 for the 9.1.x branch and 9.0.2.0 EP2 for the 9.0.x branch.

Broadcom has explicitly confirmed that no workarounds are available for any of the three CVEs, so patching is the only remediation path. In the interim, these measures reduce risk:

• Restrict the ability to create policies, views, and text-widgets to the smallest necessary set of administrators.
• Monitor audit logs for anomalous creation activity in these categories.
• Enforce network segmentation around VCF Operations management interfaces.

Vendor Security History

The VMware Aria/VCF Operations product line has accumulated a notable record of security advisories under Broadcom's stewardship. These recent advisories bear directly on this product:

The most consequential of these was CVE-2026-22719, a command injection vulnerability from VMSA-2026-0001. It was added to the CISA Known Exploited Vulnerabilities catalog in March 2026 after in-the-wild exploitation was confirmed, and Federal Civilian Executive Branch agencies were required to remediate by March 24, 2026.

Alexis Bernazzani of Visa Inc. discovered and reported the VMSA-2026-0004 vulnerabilities, which points to responsible disclosure from a major financial services organization. It also shows that enterprises with significant security programs are actively auditing the VCF Operations attack surface and finding exploitable flaws.

VMware still holds the largest share of the on-premises virtualization market in 2026, with tens of thousands of enterprise accounts. Gartner estimates, however, project that share falling from approximately 70% in 2024 to around 40% by 2029, as customers migrate following the Broadcom acquisition. Organizations evaluating their long-term virtualization strategy should count the recurring vulnerabilities in this critical management-plane component as one relevant data point.

References

• NVD: CVE-2026-41722
• Broadcom Security Advisory VMSA-2026-0004
• Broadcom Security Advisory VMSA-2026-0001
• VMware Security Advisories Portal
• CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719
• Broadcom Fixes Critical VMware Stored XSS Bugs
• VMware Aria Operations Vulnerabilities May Lead to Remote Compromise
• CISA Known Exploited Vulnerabilities Catalog
• NVD: CVE-2026-22720
• NVD: CVE-2026-22719
• VMware Aria Operations Security Update (VMSA-2026-0001) Analysis
• VMware Market Share 2026: Real Numbers