Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
DECLINING
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 4 products
| Date | Total | Labels |
|---|
| 2026-06-08 | 8 | Disclosure3General1Patch4 |
| 2026-06-09 | 1 | Patch1 |
| 2026-06-10 | 1 | Disclosure1 |
| 2026-06-12 | 1 | Disclosure1 |
| 2026-06-15 | 1 | Disclosure1 |
VMware Cloud Foundationに複数の蓄積型クロスサイトスクリプティングの脆弱性。CVE-2026-41722, CVE-2026-41723, CVE-2026-41724。修正版が提供されている。 https://cybersecuritynews.com/vmware-stored-xss-vulnerabilities/
Post summary
The post reports several stored XSS vulnerabilities in VMware Cloud Foundation and confirms that patched versions have been released.
🚨 VMware bajo riesgo por 3 fallas XSS almacenado: CVE-2026-41722, 41723 y 41724 CVSS 8.0 Un atacante autenticado podría ejecutar scripts en sesión de administrador y realizar acciones no autorizadas. ✅ Aplica parches oficiales. #BugHunterMX #VMware #XSS https://t.co/7wjXel0HEW
Post summary
The tweet announces VMware’s stored XSS vulnerabilities (CVE-2026-41722/41723/41724) with a CVSS score of 8.0 and confirms that official patches are available.
Broadcom reportó 3 XSS Stored (CVE-2026-41722/23/24) que permiten inyectar JS en VMware, afectando entornos administrativos y productos VMware. Mas información: https://www.ecucert.gob.ec/wp-content/uploads/2026/06/Al-2026-033-Vulnerabilidades-XSS-en-VMware.pdf #PorUnEcuadorCiberseguro @Arcotel_ec @CsirtCEDIA @CsirtEPN https://t.co/yTZQJaySUC
Post summary
Broadcom reported three stored XSS vulnerabilities (CVE‑2026‑41722/23/24) that enable JavaScript injection in VMware products. A PDF link is provided for additional technical details.
Warning: 3 high cross-site scripting #XSS in #VMware Cloud Foundation Operations #CVE-2026-41722 #CVE-2026-41723 #CVE-2026-41724 CVSS: 8.0 A remote attacker with low privileges can exploit them to perform admin actions. #Patch #Patch #Patch
Post summary
The text warns of three high‑severity XSS vulnerabilities in VMware Cloud Foundation (CVSS 8.0) and emphasizes the need to apply the available patch to mitigate potential admin‑level exploits.
VMware VCF Operations の脆弱性 CVE-2026-41722／41723／41724 が FIX：深刻な蓄積型 XSS https://iototsecnews.jp/2026/06/08/multiple-vmware-stored-xss-flaw-enable-attackers-to-inject-malicious-scripts/ VMware に存在する、脆弱性 CVE-2026-41722／CVE-2026-41723／CVE-2026-41724 が公表されました。この問題の原因は、管理画面からユーザーが入力したデータの検証や、出力する際のエンコード処理が不適切だったことにあります。これにより、悪意のプログラムがシステム内に保存されてしまい、他の利用者がアクセスした際に自動的に実行されてしまいます。ご利用のチームは、ご注意ください。 #CVE202641722 #CVE202641723 #VMware #VMwareVCFOperations
Post summary
VMware VCF Operations now reports three stored XSS CVEs (CVE‑2026‑41722/41723/41724) caused by inadequate input validation and output encoding, which can let attackers persist malicious scripts that execute when other users access the interface.
@The_Cyber_News Thanks for highlighting CVE-2026-41722, 41723, and 41724. Are there any mitigations recommended until patching, especially for organizations with admin accounts at higher risk of repeatable attacks?
Post summary
The post merely asks for mitigations for CVE-2026-41722 to 41724 pending a patch, providing no technical details, PoC, or evidence of exploitation.
先日の 9.1 EP1 対応のものかと思ったら 9.1 含めたリリース済みのパッチで対応してたパターンか👀 VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724) https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513?utm_campaign=VCF_FY26_VCF_VMSA-2026-0004_MKT_CM_5976&utm_content=VCF_FY26_VCF_VMSA-2026-0004_5976_SecurityAlert_MKT_TRANS_EM_11409&utm_medium=email&utm_source=eloqua
Post summary
The user confirms that the VMSA-2026-0004 patch addresses CVE-2026-41722, CVE-2026-41723, and CVE-2026-41724, referencing a Broadcom support advisory, while no PoC, exploit, or active exploitation is mentioned.
VMware Cloud Foundation Operationsに保存型XSSが可能な脆弱性(CVE-2026-41722、CVE-2026-41723、CVE-2026-41724) https://rocket-boys.co.jp/security-measures-lab/vmware-cloud-foundation-operations-stored-xss/ #セキュリティ対策Lab #security #securitynews
Post summary
The post announces stored XSS vulnerabilities (CVE‑2026‑41722, CVE‑2026‑41723, CVE‑2026‑41724) affecting VMware Cloud Foundation Operations, but does not provide exploit details, remediation, or evidence of active exploitation.
Broadcom ha revelado tres vulnerabilidades de Cross-Site Scripting (XSS) almacenado (CVE-2026-41722, 41723 y 41724) que afectan a VMware Cloud Foundation y Aria Operations. Con una severidad CVSS de 8.0, estas fallas permiten a un atacante autenticado inyectar scripts maliciosos en la plataforma. Cuando un administrador visualiza el componente afectado, el payload se ejecuta silenciosamente en su contexto, permitiendo al atacante tomar el control y realizar acciones administrativas. Al no existir mitigaciones o soluciones temporales, se urge a las organizaciones a aplicar los parches oficiales de inmediato.
Post summary
Broadcom announced three stored XSS vulnerabilities (CVE‑2026‑41722/41723/41724) affecting VMware Cloud Foundation and Aria Operations, highlighting their high severity and urging immediate patching as no temporary mitigations exist.
Broadcom disclosed three stored XSS vulnerabilities in VMware Cloud Foundation Operations and related products, CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724, rated CVSS 8.0 and enabling authenticated script injection, in advisory VMSA-2026-0004. https://threatcluster.io/cluster/vmware-cloud-foundation-operations-faces-multiple-stored-xss-0f130b09
Post summary
Broadcom announced three new stored XSS vulnerabilities in VMware Cloud Foundation Operations, detailing the CVEs, CVSS score, and authentication requirement. No PoC, exploitation, or patch details are included, making it a straightforward disclosure.
CVE-2026-41722 VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-w… https://www.cve.org/CVERecord?id=CVE-2026-41722
Post summary
CVE-2026-41722 is disclosed as a set of stored XSS flaws in VMware Cloud Foundation Operations with no mention of PoC, exploit code, active usage, or patch details.
CVE-2026-41722 Stored Cross-Site Scripting in VMware Cloud Foundation Operations https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41722
Post summary
The post provides a brief disclosure of a stored XSS vulnerability (CVE‑2026‑41722) in VMware Cloud Foundation Operations, linking to a details page but offering no PoC, exploit code, or mitigation information.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vmware | aria_operations | - | - | - |
| App | vmware | cloud_foundation | - | - | - |
| App | vmware | cloud_foundation | 9.1 | - | - |
| App | vmware | telco_cloud_platform | - | - | - |
| App | vmware | vsphere | - | - | - |
| App | vmware | vsphere | 9.1 | - | - |