VMware Cloud Foundation Operations CVE-2026-41723: Overview of Stored XSS Enabling Administrative Hijacking

Introduction

Three stored cross-site scripting vulnerabilities in VMware Cloud Foundation Operations, disclosed together in VMSA-2026-0004, allow a low-privileged authenticated user to inject persistent scripts that execute administrative actions when a higher-privileged user views them. CVE-2026-41723 is one of the three. It lands in a product family where a related command injection flaw, CVE-2026-22719, was actively exploited within 30 days of its disclosure earlier this year. That history makes the urgency of patching concrete.

Technical Information

Root Cause: Insufficient Input Sanitization

CVE-2026-41723 is a stored cross-site scripting vulnerability. VMware Cloud Foundation Operations does not properly sanitize user-supplied input in three distinct creation workflows: policies, views, and text-widgets. When an authenticated user with privileges to create any of these elements submits content containing JavaScript, the application stores the payload without adequate encoding or filtering. The browser of any later user who views the affected dashboard element then renders the malicious content verbatim.

The CVSSv3.1 vector string is AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, which gives a base score of 8.0. Each component says something about the attack surface:

Why Stored XSS Matters Here

The "stored" classification is what makes this a serious threat. Unlike a reflected XSS payload, this one persists in the application database, and every user who views the affected policy, view, or text-widget runs the script. A single injection becomes a sustained attack vector that can hijack the administrative sessions of multiple victims without the attacker having to act again.

Attack Flow

A realistic exploitation chain looks like this:

1. A low-privileged operator (or a compromised account with operator-level access) creates a policy, view, or text-widget containing embedded JavaScript. The application accepts and stores the payload because its input validation is insufficient.

2. An administrator opens the dashboard containing the poisoned element during routine work. Normal dashboard viewing satisfies the user interaction requirement (UI:R), so the attacker needs no social engineering beyond standard operations.

3. The injected script runs in the administrator's browser with their session token and full session privileges.

4. The script can perform any administrative action available through the VCF Operations web interface. That includes modifying cloud infrastructure configurations, accessing sensitive operational data, creating new administrative accounts, and planting more persistent backdoors in other dashboard elements.

5. With the hijacked admin session, the attacker can create more poisoned widgets or policies, so the attack can spread across the management interface and establish multiple persistence points.

Three Sibling Vulnerabilities

CVE-2026-41723 is one of three stored XSS flaws disclosed in VMSA-2026-0004. All three have identical CVSS vectors and descriptions and differ in the specific injection point:

Three distinct injection points with identical characteristics in one advisory strongly suggest a systemic input sanitization deficiency rather than isolated coding errors. VMSA-2026-0001 supports that reading. Published four months earlier, in February 2026, it addressed CVE-2026-22720, another stored XSS flaw in the same product family, which allowed script injection through custom benchmark definitions.

Convergence of Risk Factors

Three factors make CVE-2026-41723 more significant than its standalone CVSS score:

1. XSS keeps recurring. Two advisories in four months indicate a codebase-wide sanitization problem, which means additional undiscovered XSS vectors likely exist.
2. The Aria/VCF Operations stack is a confirmed active target. CVE-2026-22719 reached CISA KEV status within 30 days of disclosure.
3. VCF Operations manages the entire virtualized infrastructure layer. Administrative actions compromised through XSS can affect VM deployment, network configuration, and storage allocation across the enterprise.

Patch Information

Broadcom addressed CVE-2026-41723 on June 8, 2026, in security advisory VMSA-2026-0004, which bundles fixes for all three related stored XSS vulnerabilities. Broadcom confirmed that this flaw has no workarounds. The only remediation path is the vendor-supplied update.

The fix sanitizes user-supplied input in the policy, view, and text-widget creation workflows so that injected script payloads are no longer stored or rendered.

The complete remediation matrix:

VMware Aria Operations version 8.18.6 remediates CVE-2026-41723 and CVE-2026-41722 but does not address CVE-2026-41724. Only version 8.18.7 covers all three CVEs. Organizations running the standalone Aria Operations product should upgrade directly to 8.18.7 to close all three issues in a single update cycle.

Downloads for each fixed release are available through the Broadcom Support Portal.

Interim Risk Reduction

Patching is the only complete fix. Based on the documented prerequisites, these measures reduce the attack surface until you can patch:

• Limit policy, view, and text-widget creation to the minimum set of essential administrative roles. This directly shrinks the pool of accounts an attacker could use for injection.
• Review administrative dashboard access and modification logs for anomalous content, particularly unexpected JavaScript or HTML tags in policies, views, or text-widgets.
• Configure web application firewall (WAF) rules to detect common XSS payload patterns in HTTP requests targeting VCF Operations endpoints. These rules give only partial coverage against evasion techniques.
• If the deployment architecture permits, enforce Content Security Policy (CSP) headers on VCF Operations web interfaces to limit script execution contexts.

Affected Systems and Versions

The following products and version ranges are confirmed affected:

• VMware Cloud Foundation Operations (VCF Operations) versions 9.1.x.x and 9.0.x.x
• VMware Aria Operations version 8.x (all 8.x releases before 8.18.6 for CVE-2026-41723 specifically, and before 8.18.7 for complete coverage of all three sibling CVEs)
• VMware Cloud Foundation version 5.x (via the Aria Operations component)
• VMware vSphere Foundation (via the VCF Operations component)
• VMware Telco Cloud Platform version 5.x (via the Aria Operations component)

Any environment running these products with users who have privileges to create policies, views, or text-widgets is vulnerable.

Vendor Security History

Broadcom's VMware product line has had a sustained run of critical vulnerabilities over the past 18 months:

Microsoft Threat Intelligence Center reported the March 2025 zero-days. They involved a TOCTOU race condition (CVE-2025-22224) that could allow attackers with administrative access to seize hypervisor control and break out of guest OS sandboxes.

Stored XSS has now turned up in the same product family in both VMSA-2026-0001 and VMSA-2026-0004, four months apart. That recurrence signals a systemic input sanitization deficiency rather than isolated bugs. Organizations should consider a code-level audit of all user-input rendering paths in VCF Operations beyond the three patched locations.

Broadcom's security disclosure practices have also drawn scrutiny. Security researchers have noted that Broadcom failed to adequately disclose the scope of active exploitation in a timely manner for prior VMware zero-days. That has led to recommendations that organizations supplement Broadcom advisories with independent threat intelligence sources and CISA KEV monitoring.

Alexis Bernazzani of Visa Inc. privately reported the three CVEs in VMSA-2026-0004, following responsible disclosure practices.

References

• NVD: CVE-2026-41723
• Broadcom VMSA-2026-0004 Security Advisory
• Broadcom Fixes Critical VMware Stored XSS Bugs (SecurityOnline)
• Broadcom VMSA-2026-0001 Security Advisory
• VMware Aria Operations RCE (CVE-2026-22719) Analysis (OP Innovate)
• CISA Adds Actively Exploited VMware Aria Operations Flaw to KEV Catalog (The Hacker News)
• CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 (KSEC Forum)
• VMware Cloud Foundation Security Vulnerabilities in 2026 (Stack.Watch)
• VMSA-2026-0004 Analysis (Canberkki)
• VMware Cloud Foundation Overview (Broadcom TechDocs)
• Broadcom Urges Customers to Patch 3 Zero-Day VMware Flaws (Cybersecurity Dive)
• Broadcom Fails to Disclose Zero-Day Exploitation of VMware Vulnerability (SecurityWeek)
• VMware Security Advisories (Broadcom)
• Security Advisory: VMware Aria Operations Vulnerabilities (SecPod)