Description
VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// .
References (2)
Core 2
Core References
Various Sources vendor-advisory
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947
Various Sources release-notes
https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html
Scores
CVSS v3
8.0
EPSS
0.0013
EPSS Percentile
31.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-79
Status
published
Products (13)
vmware/aria_operations
8.0 - 8.18.6
vmware/cloud_foundation
4.0 - 5.2.3
vmware/telco_cloud_infrastructure
2.2 - 3.0
vmware/telco_cloud_platform
4.0 - 5.1
VMware/VMware Aria Operations
8.18.0 - 8.18.6
VMware/VMware Aria Operations
8.18.6
VMware/VMware Cloud Foundation Operations
4.x - 5.2.3
VMware/VMware Cloud Foundation Operations
5.x - 5.2.3
VMware/VMware Cloud Foundation Operations
9.x.x - 9.0.2
VMware/VMware Telco Cloud Infrastructure
2.0 - 5.2.3
... and 3 more
Published
Feb 25, 2026
Tracked Since
Feb 26, 2026