VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations.
To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// .
References
Configurations
Configuration 1 (hide)
|
History
04 Mar 2026, 15:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 - Patch, Vendor Advisory | |
| References | () https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html - Release Notes | |
| First Time |
Vmware cloud Foundation
Vmware telco Cloud Platform Vmware telco Cloud Infrastructure Vmware Vmware aria Operations |
|
| CPE | cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:* cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:* cpe:2.3:a:vmware:telco_cloud_infrastructure:*:*:*:*:*:*:*:* cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* |
25 Feb 2026, 20:23
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-25 20:23
Updated : 2026-03-04 15:55
NVD link : CVE-2026-22720
Mitre link : CVE-2026-22720
CVE.ORG link : CVE-2026-22720
JSON object : View
Products Affected
vmware
- aria_operations
- telco_cloud_platform
- cloud_foundation
- telco_cloud_infrastructure
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')