CVE-2026-41724Disclosure(vmware / aria_operations)

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch vmware aria_operations systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

vmware CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

aria_operations
cloud_foundation
telco_cloud_platform

Threat summary

Patch or workaround signal is available
8 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 7 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 2d ago at 6 mentions (2026-06-08); latest day: 1
8 total mentions across 3 days

Affected systems

Vendors

vmware

Products

aria_operationscloud_foundationtelco_cloud_platform

Deep dive

Activity timeline8 mentions / 3d

Signal classification3 categories

Disclosure

450.0%

Patch

337.5%

General

112.5%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-08	6	Disclosure2General1Patch3
2026-06-10	1	Disclosure1
2026-06-15	1	Disclosure1

Full discourse8 posts

kokumօtօ@__kokumoto136d
Patch
VMware Cloud Foundationに複数の蓄積型クロスサイトスクリプティングの脆弱性。CVE-2026-41722, CVE-2026-41723, CVE-2026-41724。修正版が提供されている。 https://cybersecuritynews.com/vmware-stored-xss-vulnerabilities/
Post summary
Three VMware Cloud Foundation stored XSS vulnerabilities (CVE-2026-41722/23/24) have been disclosed, and fixes are already available.
010731.1K
7.6K followersView on X
CCB Alert@CCBalert136d
Patch
Warning: 3 high cross-site scripting #XSS in #VMware Cloud Foundation Operations #CVE-2026-41722 #CVE-2026-41723 #CVE-2026-41724 CVSS: 8.0 A remote attacker with low privileges can exploit them to perform admin actions. #Patch #Patch #Patch
Post summary
The tweet warns about three high‑severity XSS vulnerabilities (CVE‑2026‑41722, ‑41723, ‑41724) in VMware Cloud Foundation, highlights their remote low‑privilege exploitation risk, and urges users to apply available patches.
02000229
7.2K followersView on X
iototsecnews@iototsecnews129d
Disclosure
VMware VCF Operations の脆弱性 CVE-2026-41722／41723／41724 が FIX：深刻な蓄積型 XSS https://iototsecnews.jp/2026/06/08/multiple-vmware-stored-xss-flaw-enable-attackers-to-inject-malicious-scripts/ VMware に存在する、脆弱性 CVE-2026-41722／CVE-2026-41723／CVE-2026-41724 が公表されました。この問題の原因は、管理画面からユーザーが入力したデータの検証や、出力する際のエンコード処理が不適切だったことにあります。これにより、悪意のプログラムがシステム内に保存されてしまい、他の利用者がアクセスした際に自動的に実行されてしまいます。ご利用のチームは、ご注意ください。 #CVE202641722 #CVE202641723 #VMware #VMwareVCFOperations
Post summary
The post announces the public disclosure of three VMware VCF Operations CVEs (CVE-2026-41722, 41723, 41724) as critical stored XSS flaws due to inadequate input validation and encoding, without providing exploit or patch details.
01000123
499 followersView on X
((yuki)|(kwmt)|(kawaman))@yuki_kawamitsu136d
Patch
先日の 9.1 EP1 対応のものかと思ったら 9.1 含めたリリース済みのパッチで対応してたパターンか👀 VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724) https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513?utm_campaign=VCF_FY26_VCF_VMSA-2026-0004_MKT_CM_5976&utm_content=VCF_FY26_VCF_VMSA-2026-0004_5976_SecurityAlert_MKT_TRANS_EM_11409&utm_medium=email&utm_source=eloqua
Post summary
The message notes that VMware released patch VMSA‑2026‑0004, which fixes CVE‑2026‑41722, CVE‑2026‑41723 and CVE‑2026‑41724 in Cloud Foundation Operations, with no PoC, active exploitation data, or mitigation details beyond the patch.
00010258
1.6K followersView on X
セキュリティ対策Lab@securityLab_jp134d
Disclosure
VMware Cloud Foundation Operationsに保存型XSSが可能な脆弱性(CVE-2026-41722、CVE-2026-41723、CVE-2026-41724) https://rocket-boys.co.jp/security-measures-lab/vmware-cloud-foundation-operations-stored-xss/ #セキュリティ対策Lab #security #securitynews
Post summary
The article announces stored‑XSS vulnerabilities (CVE‑2026‑41722, 41723, 41724) in VMware Cloud Foundation Operations, providing basic technical details but no evidence of exploitation or remediation.
00000101
422 followersView on X
ThreatCluster@threatcluster136d
Disclosure
Broadcom disclosed three stored XSS vulnerabilities in VMware Cloud Foundation Operations and related products, CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724, rated CVSS 8.0 and enabling authenticated script injection, in advisory VMSA-2026-0004. https://threatcluster.io/cluster/vmware-cloud-foundation-operations-faces-multiple-stored-xss-0f130b09
Post summary
Broadcom disclosed three stored XSS vulnerabilities (CVEs 2026‑41722, 2026‑41723, 2026‑41724) impacting VMware Cloud Foundation Operations with a CVSS score of 8.0, but the text provides no evidence of exploitation, patches, or PoC details.
0000059
317 followersView on X
CVE@CVEnew136d
Disclosure
CVE-2026-41724 VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-w… https://www.cve.org/CVERecord?id=CVE-2026-41724
Post summary
The snippet announces a new stored XSS vulnerability in VMware Cloud Foundation Operations (CVE-2026-41724) with a reference to the CVE record, but provides no proof‑of‑concept, exploit code, patch, or evidence of active exploitation.
00000147
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
General
CVE-2026-41724 Stored Cross-Site Scripting in VMware Cloud Foundation Operations https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41724 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet announces CVE-2026-41724, a stored XSS flaw in VMware Cloud Foundation Operations, and links to a vulnerability detail page but provides no PoC, exploit, or patch information.
0000037
4.0K followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	vmware	aria_operations	-	-	-
App	vmware	cloud_foundation	-	-	-
App	vmware	telco_cloud_platform	-	-	-

Explore more

Back to dashboard vmware CVEs aria_operations vulnerabilities

What researchers are saying

CVE-2026-41724

kokumօtօ[verified]@__kokumotoPatch

Three VMware Cloud Foundation stored XSS vulnerabilities (CVE-2026-41722/23/24) have been disclosed, and fixes are already available.

セキュリティ対策Lab[verified]@securityLab_jpDisclosure

The article announces stored‑XSS vulnerabilities (CVE‑2026‑41722, 41723, 41724) in VMware Cloud Foundation Operations, providing basic technical details but no evidence of exploitation or remediation.

ThreatCluster[verified]@threatclusterDisclosure

Broadcom disclosed three stored XSS vulnerabilities (CVEs 2026‑41722, 2026‑41723, 2026‑41724) impacting VMware Cloud Foundation Operations with a CVSS score of 8.0, but the text provides no evidence of exploitation, patches, or PoC details.

CCB Alert@CCBalertPatch

The tweet warns about three high‑severity XSS vulnerabilities (CVE‑2026‑41722, ‑41723, ‑41724) in VMware Cloud Foundation, highlights their remote low‑privilege exploitation risk, and urges users to apply available patches.

iototsecnews@iototsecnewsDisclosure

The post announces the public disclosure of three VMware VCF Operations CVEs (CVE-2026-41722, 41723, 41724) as critical stored XSS flaws due to inadequate input validation and encoding, without providing exploit or patch details.

((yuki)|(kwmt)|(kawaman))@yuki_kawamitsuPatch

The message notes that VMware released patch VMSA‑2026‑0004, which fixes CVE‑2026‑41722, CVE‑2026‑41723 and CVE‑2026‑41724 in Cloud Foundation Operations, with no PoC, active exploitation data, or mitigation details beyond the patch.

CVE@CVEnewDisclosure

The snippet announces a new stored XSS vulnerability in VMware Cloud Foundation Operations (CVE-2026-41724) with a reference to the CVE record, but provides no proof‑of‑concept, exploit code, patch, or evidence of active exploitation.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The tweet announces CVE-2026-41724, a stored XSS flaw in VMware Cloud Foundation Operations, and links to a vulnerability detail page but provides no PoC, exploit, or patch information.