CVE-2026-41724
📛 CVE Title
(no title)
Description
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- high
- CVSS score
- —
- CVSS vector
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H- Effective score
- 8.0 / 10 HIGH source: NVD
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2026-41724
- Linked Threat
- CVE-2026-41724 — CVE-2026-41724
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-06-08 09:16:30 UTC
- NVD last modified
- 2026-07-23 07:10:00 UTC
- NVD CVSS v3.1
- 8.0 / 10 HIGH source: security@vmware.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H- Exploitability subscore
- 2.1 / 10
- Impact subscore
- 5.9 / 10
- EPSS score
- 0.0031 (probability of exploitation in next 30 days)
- EPSS percentile
- 23.74% vs all CVEs — higher = more likely to be exploited, as of 2026-08-01
NVD-assigned CWE(s):
CWE-79
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-08-01 16:32 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-35032 - Assigner
- vmware
- Published
- Jun 8, 2026, 7:07:04 AM
- Updated
- Jun 9, 2026, 11:51:48 AM
- EUVD base score (CVSS 3.1)
-
8.0 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - EUVD-reported EPSS
- 0.3100
- Vendors
- VMware
- Products
-
VCF operations (5.x ≤8.18.7)VMware Telco Cloud Platform (5.x ≤8.18.7)VMware Aria Operations (8.18.x ≤8.18.7)
- Aliases
-
GHSA-76rr-q8xf-r868
ENISA description: VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.
Affected products — CPE 2.3 (3) NVD
NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.
cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:*cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (4)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2026-41724 tenable:nvd.nist.gov
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513 tenable:support.broadcom.com
- https://www.cve.org/CVERecord?id=CVE-2026-41724 tenable:www.cve.org
- https://www.first.org/epss/ tenable:www.first.org
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513 security@vmware.com Third Party Advisory
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:app.opencve.io
No vendor fix or workaround currently provided. OpenCVE Recommended Actions Apply the vendor‑provided security patch or update to a version that addresses the stored XSS issue. Restrict user privileges to limit who can create or edit policies, views or widgets, ensuring only trusted administrators have these capabilities. Disable or remove the creation of text widgets or other user ...
2026-06-19 02:38 UTC -
web:cvefeed.io
Apply patches to fix stored XSS vulnerabilities allowing script injection. Update VMware Cloud Foundation Operations. Patch the affected components. Restrict policy creation access.
2026-06-19 02:38 UTC -
web:cvefeed.io
Update VMware Cloud Foundation Operations to the latest version to fix cross-site scripting vulnerabilities.
2026-06-19 02:38 UTC -
web:cybersecuritynews.com
Broadcom has disclosed three stored cross-site scripting (XSS) vulnerabilities affecting VMware Cloud Foundation Operations and several related products, warning that authenticated attackers could inject malicious scripts to perform administrative actions within the environment.
2026-06-19 02:38 UTC -
web:infosecbulletin.com
Broadcom has revealed three stored cross-site scripting (XSS) flaws that affect VMware Cloud Foundation Operations and some other products. They warn that attackers who are logged in could add harmful scripts to do admin tasks in the system. Tracked as CVE - 2026 -41722, CVE - 2026 -41723, and CVE-2026-41724 , the issues were fixed in the security notice VMSA- 2026 -0004, released on June 8, 2026 .
2026-06-19 02:38 UTC -
web:knowledge.broadcom.com
Patch Availability for VMware Telco Cloud Platform / Telco Cloud Infrastructure
2026-06-19 02:38 UTC -
web:nvd.nist.gov
You are viewing this page in an unauthorized frame window. This is a potential security issue, you are being redirected to https://nvd.nist.gov
2026-06-19 02:38 UTC -
web:officialfixdessertchocolatier.com
Indulge in Dubai's viral chocolate bars with FIX Dessert Chocolatier. Shop our hero collection featuring Baklawa, Knafeh, Biscoff, and more. Fast delivery in Dubai & Abu Dhabi. Order now!
2026-06-19 02:38 UTC -
web:support.broadcom.com
VMSA- 2026 -0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities ( CVE - 2026 -41722, CVE - 2026 -41723 and CVE-2026-41724 )
2026-06-19 02:38 UTC -
web:www.thehackerwire.com
CVE-2026-41724 is a High severity vulnerability (CVSS 8). VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets...
2026-06-19 02:38 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.