VMware Cloud Foundation Operations CVE-2026-41724: Overview of Stored XSS Leading to Admin Privilege Escalation

Introduction

A trio of stored cross-site scripting vulnerabilities in VMware Cloud Foundation Operations lets any authenticated user who can create policies, views, or text widgets inject persistent scripts. Those scripts execute with full administrative privileges when an admin views the compromised content. VMware's operations management stack spans five distinct product lines, and organizations that run it rely on it to monitor and manage their entire virtualized infrastructure. For them, this is a practical privilege-escalation path from a low-privileged account to complete administrative control.

CVE-2026-41724 is the third of three related flaws disclosed in Broadcom's VMSA-2026-0004 advisory on June 8, 2026, and it targets the text widget creation flow. All three CVEs carry a CVSS 3.1 base score of 8.0 (High), and none of them has a workaround.

Technical Information

Root Cause: Missing Input Sanitization Across Content Creation Interfaces

CVE-2026-41724 is classified as a stored cross-site scripting vulnerability, mapping to CWE-79 (Improper Neutralization of Input During Web Page Generation). The text widget creation flow in VMware Cloud Foundation Operations fails to properly sanitize and encode user-supplied input. When a user creates a text widget, the application stores the content as provided, without neutralizing embedded script payloads. Later, another user's browser renders that content (typically an administrator reviewing dashboards or operational views), and the injected script executes in the context of that user's authenticated session.

The CVSS v3.1 vector string is AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, which breaks down as follows:

Three Injection Surfaces, One Systemic Weakness

VMSA-2026-0004 bundles three distinct CVEs, each targeting a different content creation interface within the same product:

Three separate injection surfaces with the same class of vulnerability indicate that VMware Cloud Foundation Operations lacked consistent input sanitization across its content creation features. That points to a systemic gap in how the product handles user-supplied content before storage and rendering, more than to a single isolated coding error.

Attack Flow

The exploitation chain for CVE-2026-41724 proceeds as follows:

1. Initial Access: The attacker authenticates to VMware Cloud Foundation Operations with a low-privileged account that has permission to create text widgets. Operations team members who build and customize dashboards commonly hold this permission.

2. Payload Injection: The attacker creates or modifies a text widget and embeds malicious JavaScript in its content. Because the application does not sanitize or encode the input, the backend stores the script verbatim.

3. Persistence: The script now sits on the server. Reflected XSS requires the victim to click a crafted link. A stored XSS payload survives indefinitely and executes every time the compromised content is rendered.

4. Trigger: A legitimate administrator navigates to a dashboard or view that includes the compromised text widget. The application renders the widget content, including the injected script, in the administrator's browser.

5. Execution with Elevated Privileges: The injected JavaScript executes within the administrator's authenticated browser session. Because the administrator holds full administrative privileges in VCF Operations, the script can perform arbitrary administrative actions: creating new admin accounts, modifying monitoring policies, exfiltrating configuration data, or disabling security controls.

The attack works because of the privilege differential. The attacker needs only low-level access to inject the payload, but the payload runs at the privilege level of whoever views the content, and in an operations management tool that viewer is almost always an administrator.

Credit

Broadcom credited Alexis Bernazzani of Visa Inc. with reporting these vulnerabilities, which suggests responsible disclosure by a major financial institution's security team.

Patch Information

Broadcom published security advisory VMSA-2026-0004 on June 8, 2026, with patches for CVE-2026-41724 and its sibling stored XSS flaws, CVE-2026-41722 and CVE-2026-41723. Because these are stored XSS vulnerabilities, the patch addresses the underlying failure to properly sanitize and encode user-supplied input in the policy, view, and text widget creation flows. With input validation and output encoding corrected at these injection points, an administrator's browser renders injected script payloads as inert text instead of executable code.

No workarounds exist. Applying the vendor-supplied fixed versions is the only remediation path.

Read the advisory's Response Matrix carefully. The fixed version depends on which product line you run, and not every fixed version covers CVE-2026-41724:

If you run VMware Aria Operations 8.x (standalone or bundled with VCF 5.x or Telco Cloud Platform 5.x), you must upgrade to version 8.18.7 to fully remediate CVE-2026-41724. Version 8.18.6 covers only CVE-2026-41722 and CVE-2026-41723, so upgrading to 8.18.6 alone leaves CVE-2026-41724 unpatched. For VCF Operations 9.x environments, the 9.1.0.0 and 9.0.2.0 EP2 builds handle CVE-2026-41724 alongside the other two CVEs.

Defense in Depth Measures

Patching is the definitive fix. Until it is in place, these measures can reduce the likelihood of exploitation:

• Restrict text widget, policy, and view creation privileges to essential personnel. The attack requires these specific permissions, so limiting the pool of users who hold them directly reduces the attack surface.
• Enable Content Security Policy (CSP) in VMware Aria Operations. Broadcom documents CSP support in the product specifically to mitigate this class of vulnerability. Properly configured CSP can restrict script execution contexts and limit the impact of injected payloads.
• Monitor administrative action logs for anomalous text widget, policy, or view modifications from low-privileged accounts, which could indicate exploitation attempts.

Affected Systems and Versions

The vulnerability affects the following products and version ranges:

• VMware Cloud Foundation Operations versions 9.1.x.x (prior to 9.1.0.0)
• VMware Cloud Foundation Operations versions 9.0.x.x (prior to 9.0.2.0 EP2)
• VMware Aria Operations (standalone) version 8.x (prior to 8.18.7)
• VMware Cloud Foundation 5.x with embedded Aria Operations component (prior to Aria Operations 8.18.7)
• VMware vSphere Foundation with VCF Operations component (versions 9.0.x.x and 9.1.x.x, prior to the fixed builds listed above)
• VMware Telco Cloud Platform 5.x with embedded Aria Operations component (prior to the fix documented in KB443138)

That is a broad product surface. A significant portion of VMware's approximately 500,000 enterprise customers worldwide deploy VMware Cloud Foundation, and VCF Operations / Aria Operations is the centralized monitoring and management plane for these environments.

Vendor Security History

The VMware Aria Operations and VCF Operations product family has a documented pattern of recurring stored XSS vulnerabilities:

This is the third stored XSS advisory affecting the same product family in under two years. Each advisory has fixed the specific injection points that were reported, and new injection surfaces have kept emerging. The pattern suggests that Broadcom has been handling XSS reactively, fixing each reported injection point individually instead of implementing a product-wide input sanitization framework.

A separate incident is also relevant. In October 2025, SecurityWeek reported that Broadcom failed to disclose that Chinese state-linked actors had been exploiting a previously patched VMware vulnerability as a zero day since mid-October 2024. The flaw was exploited in the wild for approximately a year before it was patched, and Broadcom did not inform customers about the active exploitation when it released the patch. That raises questions about how complete Broadcom's vulnerability communications are, and whether the absence of reported exploitation for CVE-2026-41724 can be taken at face value.

As of the June 8, 2026 disclosure date, public sources report no active exploitation of CVE-2026-41724. The NVD record is still in "Received" status with no independent CVSS assessment yet, so the CVSS 8.0 score is vendor assigned and may be revised.

References

• CVE-2026-41724 Detail, NVD
• VMSA-2026-0004, Broadcom Security Advisory
• Broadcom Fixes Critical VMware Stored XSS Bugs, SecurityOnline
• Multiple VMware Stored XSS Vulnerabilities Allow Administrative Actions, CybersecurityNews
• CVE-2026-41724, CVEFeed.io
• VMware Cloud Foundation Security Vulnerabilities in 2026, Stack.Watch
• Content Security Policy in VMware Aria Operations, Broadcom Knowledge Base
• Broadcom Fails to Disclose Zero Day Exploitation of VMware Vulnerability, SecurityWeek
• VMware Fixed Five Vulnerabilities in Aria Operations Product, SecurityAffairs
• VMware Patches Multiple Vulnerabilities, SecPod
• VMware Security Advisories, Broadcom
• VMSA-2026-0001, Broadcom Security Advisory