CVE-2026-22720
Received Received - Intake
Stored XSS in VMware Aria Operations Allows Admin Actions

Publication date: 2026-02-25

Last updated on: 2026-03-04

Assigner: VMware

Description
VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations.  To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of  VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// .
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-25
Last Modified
2026-03-04
Generated
2026-06-16
AI Q&A
2026-02-25
EPSS Evaluated
2026-06-15
NVD
CVE-2026-22720
EUVD
EUVD-2026-8709
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
vmware telco_cloud_infrastructure From 2.2 (inc) to 3.0 (inc)
vmware aria_operations From 8.0 (inc) to 8.18.6 (exc)
vmware cloud_foundation From 4.0 (inc) to 5.2.3 (exc)
vmware cloud_foundation From 9.0 (inc) to 9.0.2.0 (exc)
vmware telco_cloud_platform From 4.0 (inc) to 5.1 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

VMware Aria Operations contains a stored cross-site scripting (XSS) vulnerability. This means that a malicious actor who has privileges to create custom benchmarks within the system can inject malicious scripts. These scripts could then be executed in the context of the application, potentially allowing the attacker to perform unauthorized administrative actions within VMware Aria Operations.

Impact Analysis

The vulnerability can have a significant impact because it allows an attacker with certain privileges to execute arbitrary scripts within VMware Aria Operations. This can lead to unauthorized administrative actions, which may compromise the integrity, confidentiality, and availability of the system. The CVSS base score of 8.0 indicates a high severity, with potential impacts including complete compromise of confidentiality, integrity, and availability.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

[{'type': 'paragraph', 'content': "To mitigate CVE-2026-22720, you should apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of VMSA-2026-0001."}, {'type': 'paragraph', 'content': 'Specifically, upgrading to VMware Aria Operations version 8.18.6, released on February 24, 2026, addresses this vulnerability along with other key security issues.'}, {'type': 'paragraph', 'content': 'Before upgrading, ensure to back up or clone any custom content such as alerts, policies, and dashboards, as upgrading resets out-of-the-box content.'}, {'type': 'paragraph', 'content': 'Also, create snapshots of each cluster node before the upgrade and delete them afterward to avoid performance issues.'}, {'type': 'paragraph', 'content': 'Migrate from deprecated components such as remote collectors to cloud proxies as required by the new version.'}] [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-22720. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart