Vulnerability · Published Feb 25, 2026 · Assigned by vmware

CVE-2026-22720VMware Aria Operations stored cross-site scripting vulnerability

High 8.0

In plain English

A high-severity cross-site scripting in VMware Aria Operations from VMware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)8.0High

Exploit odds (30 days)0.4%top 60.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// .

Affected products (as reported)

Vendor	Product	Versions
VMware	VMware Aria Operations	8.18.0 – before 8.18.6
VMware	VMware Cloud Foundation Operations	4.x – before 5.2.39.x.x – before 9.0.2
VMware	VMware Telco Cloud Platform	4.0 – before 5.2.3
VMware	VMware Telco Cloud Infrastructure	2.0 – before 5.2.3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

VMSA-2026-0001: VMware Aria Operations updates (includes CVE-2026-22720) vendor-advisory
VMware Aria Operations 8.18.6 Release Notes (resolves CVE-2026-22720) release-notes