Multiple VMware Stored XSS Vulnerabilities Allow Attackers to Inject Malicious Scripts

Cybersecuritynews •Guru Baran • June 8, 2026

Broadcom has disclosed three stored cross-site scripting (XSS) vulnerabilities affecting VMware Cloud Foundation Operations and several related products, warning that authenticated attackers could inject malicious scripts to perform administrative actions within the environment. Tracked as CVE-2026-41722, CVE-2026-41723, and CVE-2026-41724, the flaws were addressed in security advisory VMSA-2026-0004, published on June 8, 2026. Each vulnerability carries […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

VMware Cloud Foundation Operations Faces Multiple Stored XSS Vulnerabilities Broadcom has disclosed three stored cross-site scripting (XSS) vulnerabilities in VMware Cloud Foundation Operations and related products. The vulnerabilities, tracked as CVE-2026-41722, CVE-2026-41723, and CVE-2026-41724, allow authenticated attackers to inject malicious scripts that can perform administrative actions. These vulnerabilities have a CVSS score of 8.0, indicating a high severity level. Affected products include VMware Cloud Foundation and vSphere Foundation versions 9.1.0 and 9.0.2.0 EP2, as well as VMware Aria Operations. Broadcom advises that no active exploitation has been reported, but administrators should apply patches immediately to mitigate risks. There are no temporary workarounds available; only updates to the patched versions will resolve the issues. The vulnerabilities were privately reported and have been addressed in security advisory VMSA-2026-0004. 6 sources 61

Extracted Entities

Multiple VMware Stored XSS Vulnerabilities Allow Attackers to Inject Malicious Scripts

The full story

Extracted Entities

CVEs (3)

CWE Weaknesses (1)

Platforms (2)

Vulnerabilities (1)