CVE-2026-41722: VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)

Synopsis

Stored cross-site scripting (XSS) vulnerabilities in VMware Cloud Foundation Operations allow an authenticated attacker with policy, view, or text-widget creation privileges to inject malicious scripts into the application. The attack is reachable over the network and requires a victim to trigger the stored payload, typically by viewing an affected dashboard or page. Successful exploitation allows the attacker to perform administrative actions within the application on behalf of the victim. No fix versions have been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild as soon as upstream releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable application must be reachable over the network; an attacker submits the malicious script payload via the network to a policy, view, or text-widget endpoint.

• AuthenticationRequired

  A low-privilege account with rights to create policies, views, or text widgets is sufficient; unauthenticated access alone does not expose the injection surface.

• Victim interactionRequired

  A victim (typically a higher-privileged user or administrator) must load the page or dashboard containing the injected script for it to execute.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond the attacker having the necessary account.

Blast Radius

• An attacker whose payload executes in a victim's browser session can issue administrative API calls within VMware Cloud Foundation Operations at the victim's privilege level.
• Session tokens or authentication cookies accessible to the injected script can be read and exfiltrated, enabling session hijacking.
• Application configuration, policies, and operational data can be modified or deleted through actions performed in the victim's authenticated context.
• Service disruption is possible if the injected script triggers operations that destabilize the affected environment or lock out legitimate administrators.