CVE-2026-41723: VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)

Synopsis

Stored cross-site scripting (XSS) vulnerabilities affect VMware Cloud Foundation Operations, VMware Aria Operations, and VMware Telco Cloud Platform. An authenticated attacker with low-level privileges can reach the flaw over the network by injecting malicious scripts into policies, views, or text widgets; the injected script executes when a victim visits the affected page. Successful exploitation gives the attacker full administrative control over the Operations environment, including the ability to read, modify, or destroy data. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the VMware Cloud Foundation Operations web interface over the network to deliver the injected script payload.

• AuthenticationRequired

  A low-privilege account with rights to create policies, views, or text widgets is sufficient; no administrative credentials are needed to plant the payload.

• Victim interactionRequired

  A higher-privileged user (such as an administrator) must visit the page containing the injected script for the payload to execute in their browser session.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or other environmental pre-conditions beyond the attacker holding a qualifying account.

Blast Radius

• Reads session tokens and authentication credentials of the victim user, potentially including administrative accounts.
• Performs administrative actions within VMware Cloud Foundation Operations on behalf of the victim, such as modifying configurations or access-control policies.
• Exfiltrates sensitive operational data visible to the hijacked session, including infrastructure topology and monitoring data.
• Disrupts or tampers with platform management by altering or deleting policies, views, and widget configurations under the victim's privileges.