CVE-2026-22720
Stored XSS in VMware Aria Operations Allows Admin Actions
Publication date: 2026-02-25
Last updated on: 2026-03-04
Assigner: VMware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vmware | telco_cloud_infrastructure | From 2.2 (inc) to 3.0 (inc) |
| vmware | aria_operations | From 8.0 (inc) to 8.18.6 (exc) |
| vmware | cloud_foundation | From 4.0 (inc) to 5.2.3 (exc) |
| vmware | cloud_foundation | From 9.0 (inc) to 9.0.2.0 (exc) |
| vmware | telco_cloud_platform | From 4.0 (inc) to 5.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
VMware Aria Operations contains a stored cross-site scripting (XSS) vulnerability. This means that a malicious actor who has privileges to create custom benchmarks within the system can inject malicious scripts. These scripts could then be executed in the context of the application, potentially allowing the attacker to perform unauthorized administrative actions within VMware Aria Operations.
How can this vulnerability impact me? :
The vulnerability can have a significant impact because it allows an attacker with certain privileges to execute arbitrary scripts within VMware Aria Operations. This can lead to unauthorized administrative actions, which may compromise the integrity, confidentiality, and availability of the system. The CVSS base score of 8.0 indicates a high severity, with potential impacts including complete compromise of confidentiality, integrity, and availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': "To mitigate CVE-2026-22720, you should apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of VMSA-2026-0001."}, {'type': 'paragraph', 'content': 'Specifically, upgrading to VMware Aria Operations version 8.18.6, released on February 24, 2026, addresses this vulnerability along with other key security issues.'}, {'type': 'paragraph', 'content': 'Before upgrading, ensure to back up or clone any custom content such as alerts, policies, and dashboards, as upgrading resets out-of-the-box content.'}, {'type': 'paragraph', 'content': 'Also, create snapshots of each cluster node before the upgrade and delete them afterward to avoid performance issues.'}, {'type': 'paragraph', 'content': 'Migrate from deprecated components such as remote collectors to cloud proxies as required by the new version.'}] [1]