« Volver al listado

CVE-2026-41722

Estado: AnalizadaMedia (5.4)—

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Vmware — Aria OperationsVmware — Cloud FoundationVmware — Telco Cloud PlatformVmware — Vsphere

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-41722",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41722",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-09T03:55:32.470083Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "VMware",
          "product": "VCF operations",
          "versions": [
            {
              "status": "affected",
              "version": "9.1.x.x",
              "versionType": "custom",
              "lessThanOrEqual": "9.1.0.0"
            },
            {
              "status": "affected",
              "version": "9.0.x.x",
              "versionType": "custom",
              "lessThanOrEqual": "9.0.2.0 EP2"
            },
            {
              "status": "affected",
              "version": "5.x",
              "versionType": "custom",
              "lessThanOrEqual": "8.18.7"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "VMware",
          "product": "VMware Aria Operations",
          "versions": [
            {
              "status": "affected",
              "version": "8.18.x",
              "versionType": "custom",
              "lessThanOrEqual": "8.18.6"
            },
            {
              "status": "affected",
              "version": "8.18.x",
              "versionType": "custom",
              "lessThanOrEqual": "8.18.7"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "VMware",
          "product": "VMware Telco Cloud Platform",
          "versions": [
            {
              "status": "affected",
              "version": "5.x",
              "versionType": "custom",
              "lessThanOrEqual": "8.18.7"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-06-08T09:16:30.363",
  "references": [
    {
      "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/37513",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundation Operations."
    },
    {
      "lang": "es",
      "value": "VMware Cloud Foundation Operations contiene múltiples vulnerabilidades de cross-site scripting almacenado. Un actor malicioso con privilegios para crear políticas, vistas o widgets de texto podría inyectar scripts para realizar acciones administrativas en VMware Cloud Foundation Operations."
    }
  ],
  "lastModified": "2026-07-23T07:10:00.113",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D15E98E-D17E-41F9-BDC1-2094AAD6B6AD",
              "versionEndExcluding": "8.18.7",
              "versionStartIncluding": "8.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B445F6BB-4CFA-45DC-BD63-BDB6822BC288",
              "versionEndExcluding": "8.18.7",
              "versionStartIncluding": "5.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11F5C577-620E-4BD7-9429-E2FDC70D6667",
              "versionEndExcluding": "9.0.2.0",
              "versionStartIncluding": "9.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:cloud_foundation:9.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9C8C8DF-F0A6-464F-A2D9-6080DE0D533A"
            },
            {
              "criteria": "cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FBCDB900-3054-42C8-B2CD-4631084275CA",
              "versionEndIncluding": "5.1",
              "versionStartIncluding": "5.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D71DEB9E-A7B5-4117-9809-934EC2D73E27",
              "versionEndExcluding": "9.0.2.0",
              "versionStartIncluding": "9.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:vsphere:9.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "065D242A-D04E-48EF-A907-2EE184050950"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}