CVE-2026-22720

Received Received - Intake

Stored XSS in VMware Aria Operations Allows Admin Actions

Publication date: 2026-02-25

Last updated on: 2026-03-04

Assigner: VMware

Description

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// .

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-25

Last Modified

2026-03-04

Generated

2026-07-06

AI Q&A

2026-02-25

EPSS Evaluated

2026-07-05

NVD

CVE-2026-22720

EUVD

EUVD-2026-8709

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	telco_cloud_infrastructure	From 2.2 (inc) to 3.0 (inc)
vmware	aria_operations	From 8.0 (inc) to 8.18.6 (exc)
vmware	cloud_foundation	From 4.0 (inc) to 5.2.3 (exc)
vmware	cloud_foundation	From 9.0 (inc) to 9.0.2.0 (exc)
vmware	telco_cloud_platform	From 4.0 (inc) to 5.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

VMware Aria Operations contains a stored cross-site scripting (XSS) vulnerability. This means that a malicious actor who has privileges to create custom benchmarks within the system can inject malicious scripts. These scripts could then be executed in the context of the application, potentially allowing the attacker to perform unauthorized administrative actions within VMware Aria Operations.

Impact Analysis

The vulnerability can have a significant impact because it allows an attacker with certain privileges to execute arbitrary scripts within VMware Aria Operations. This can lead to unauthorized administrative actions, which may compromise the integrity, confidentiality, and availability of the system. The CVSS base score of 8.0 indicates a high severity, with potential impacts including complete compromise of confidentiality, integrity, and availability.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

[{'type': 'paragraph', 'content': "To mitigate CVE-2026-22720, you should apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of VMSA-2026-0001."}, {'type': 'paragraph', 'content': 'Specifically, upgrading to VMware Aria Operations version 8.18.6, released on February 24, 2026, addresses this vulnerability along with other key security issues.'}, {'type': 'paragraph', 'content': 'Before upgrading, ensure to back up or clone any custom content such as alerts, policies, and dashboards, as upgrading resets out-of-the-box content.'}, {'type': 'paragraph', 'content': 'Also, create snapshots of each cluster node before the upgrade and delete them afterward to avoid performance issues.'}, {'type': 'paragraph', 'content': 'Migrate from deprecated components such as remote collectors to cloud proxies as required by the new version.'}] [1]

Hi! I’m here to help you understand CVE-2026-22720. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70