CVE-2026-22720

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22720", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-01-09T06:54:36.841Z", "datePublished": "2026-02-25T19:33:14.729Z", "dateUpdated": "2026-04-14T10:40:29.059Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-04-14T10:40:29.059Z"}, "title": "VMware Aria Operations stored cross-site scripting vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "affected": [{"vendor": "VMware", "product": "VMware Aria Operations", "packageName": "vmware-aria-operations", "versions": [{"status": "affected", "version": "8.18.0", "lessThan": "8.18.6", "versionType": "custom"}, {"status": "unaffected", "version": "8.18.6"}], "defaultStatus": "affected"}, {"vendor": "VMware", "product": "VMware Cloud Foundation Operations", "packageName": "VMware Cloud Foundation Operations", "versions": [{"status": "affected", "version": "4.x", "lessThan": "5.2.3", "versionType": "custom"}, {"status": "affected", "version": "9.x.x", "lessThan": "9.0.2", "versionType": "custom"}, {"status": "unaffected", "version": "5.x", "lessThan": "5.2.3", "versionType": "custom"}], "defaultStatus": "affected"}, {"vendor": "VMware", "product": "VMware Telco Cloud Platform", "packageName": "vmware-telco-cloud-platform", "versions": [{"status": "affected", "version": "4.0", "lessThan": "5.2.3", "versionType": "custom"}, {"status": "unaffected", "version": "5.2.3", "versionType": "custom"}], "defaultStatus": "affected"}, {"vendor": "VMware", "product": "VMware Telco Cloud Infrastructure", "packageName": "vmware-telco-cloud-infrastructure", "versions": [{"status": "affected", "version": "2.0", "lessThan": "5.2.3", "versionType": "custom"}, {"status": "unaffected", "version": "5.2.3"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations.\u00a0\n\nTo remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of\u00a0 VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// .", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations.&nbsp;</p><p>To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https://\">VMSA-2026-0001</a>.</p>"}]}], "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947", "name": "VMSA-2026-0001: VMware Aria Operations updates (includes CVE-2026-22720)", "tags": ["vendor-advisory"]}, {"url": "https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html", "name": "VMware Aria Operations 8.18.6 Release Notes (resolves CVE-2026-22720)", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "Apply the vendor patches listed in the 'Fixed Version' column of the Response Matrix of\u00a0 VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 . Fixed versions include VMware Aria Operations 8.18.6 (for 8.x) and VMware Cloud Foundation Operations 9.0.2.0 (for 9.x).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Apply the vendor patches listed in the 'Fixed Version' column of the Response Matrix of&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947\">VMSA-2026-0001</a>. Fixed versions include VMware Aria Operations 8.18.6 (for 8.x) and VMware Cloud Foundation Operations 9.0.2.0 (for 9.x).</p>"}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22720", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T04:56:16.136372Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:05.372Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22720", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T04:56:16.136372Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:55:38.816Z"}}], "cna": {"title": "VMware Aria Operations stored cross-site scripting vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VMware", "product": "VMware Aria Operations", "versions": [{"status": "affected", "version": "8.18.0", "lessThan": "8.18.6", "versionType": "custom"}, {"status": "unaffected", "version": "8.18.6"}], "packageName": "vmware-aria-operations", "defaultStatus": "affected"}, {"vendor": "VMware", "product": "VMware Cloud Foundation Operations", "versions": [{"status": "affected", "version": "4.x", "lessThan": "5.2.3", "versionType": "custom"}, {"status": "affected", "version": "9.x.x", "lessThan": "9.0.2", "versionType": "custom"}, {"status": "unaffected", "version": "5.x", "lessThan": "5.2.3", "versionType": "custom"}], "packageName": "VMware Cloud Foundation Operations", "defaultStatus": "affected"}, {"vendor": "VMware", "product": "VMware Telco Cloud Platform", "versions": [{"status": "affected", "version": "4.0", "lessThan": "5.2.3", "versionType": "custom"}, {"status": "unaffected", "version": "5.2.3", "versionType": "custom"}], "packageName": "vmware-telco-cloud-platform", "defaultStatus": "affected"}, {"vendor": "VMware", "product": "VMware Telco Cloud Infrastructure", "versions": [{"status": "affected", "version": "2.0", "lessThan": "5.2.3", "versionType": "custom"}, {"status": "unaffected", "version": "5.2.3"}], "packageName": "vmware-telco-cloud-infrastructure", "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "Apply the vendor patches listed in the 'Fixed Version' column of the Response Matrix of\u00a0 VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 . Fixed versions include VMware Aria Operations 8.18.6 (for 8.x) and VMware Cloud Foundation Operations 9.0.2.0 (for 9.x).", "supportingMedia": [{"type": "text/html", "value": "<p>Apply the vendor patches listed in the 'Fixed Version' column of the Response Matrix of&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947\">VMSA-2026-0001</a>. Fixed versions include VMware Aria Operations 8.18.6 (for 8.x) and VMware Cloud Foundation Operations 9.0.2.0 (for 9.x).</p>", "base64": false}]}], "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947", "name": "VMSA-2026-0001: VMware Aria Operations updates (includes CVE-2026-22720)", "tags": ["vendor-advisory"]}, {"url": "https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html", "name": "VMware Aria Operations 8.18.6 Release Notes (resolves CVE-2026-22720)", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations.\u00a0\n\nTo remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of\u00a0 VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// .", "supportingMedia": [{"type": "text/html", "value": "<p>VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations.&nbsp;</p><p>To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https://\">VMSA-2026-0001</a>.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-04-14T10:40:29.059Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22720", "state": "PUBLISHED", "dateUpdated": "2026-04-14T10:40:29.059Z", "dateReserved": "2026-01-09T06:54:36.841Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-02-25T19:33:14.729Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "packageName": "vmware-aria-operations", "product": "VMware Aria Operations", "vendor": "VMware", "versions": [{"lessThan": "8.18.6", "status": "affected", "version": "8.18.0", "versionType": "custom"}, {"status": "unaffected", "version": "8.18.6"}]}, {"defaultStatus": "affected", "packageName": "VMware Cloud Foundation Operations", "product": "VMware Cloud Foundation Operations", "vendor": "VMware", "versions": [{"lessThan": "5.2.3", "status": "affected", "version": "4.x", "versionType": "custom"}, {"lessThan": "9.0.2", "status": "affected", "version": "9.x.x", "versionType": "custom"}, {"lessThan": "5.2.3", "status": "unaffected", "version": "5.x", "versionType": "custom"}]}, {"defaultStatus": "affected", "packageName": "vmware-telco-cloud-platform", "product": "VMware Telco Cloud Platform", "vendor": "VMware", "versions": [{"lessThan": "5.2.3", "status": "affected", "version": "4.0", "versionType": "custom"}, {"status": "unaffected", "version": "5.2.3", "versionType": "custom"}]}, {"defaultStatus": "affected", "packageName": "vmware-telco-cloud-infrastructure", "product": "VMware Telco Cloud Infrastructure", "vendor": "VMware", "versions": [{"lessThan": "5.2.3", "status": "affected", "version": "2.0", "versionType": "custom"}, {"status": "unaffected", "version": "5.2.3"}]}], "source": "security@vmware.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:aria_operations:*:*:*:*:*:*:*:*", "matchCriteriaId": "6748CC5F-63A6-459A-A0B4-D12A149AD2DB", "versionEndExcluding": "8.18.6", "versionStartIncluding": "8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*", "matchCriteriaId": "16C87F30-12CA-43F5-9057-BBE32666A515", "versionEndExcluding": "5.2.3", "versionStartIncluding": "4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*", "matchCriteriaId": "11F5C577-620E-4BD7-9429-E2FDC70D6667", "versionEndExcluding": "9.0.2.0", "versionStartIncluding": "9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:telco_cloud_infrastructure:*:*:*:*:*:*:*:*", "matchCriteriaId": "904AA81A-D1C3-4DAF-BB2C-C51FEDF5B3F6", "versionEndIncluding": "3.0", "versionStartIncluding": "2.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:telco_cloud_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "9A8AE269-DD3E-4A60-91C1-D5C1FEAF0CF4", "versionEndIncluding": "5.1", "versionStartIncluding": "4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations.\u00a0\n\nTo remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of\u00a0 VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// ."}, {"lang": "es", "value": "VMware Aria Operations contiene una vulnerabilidad de cross-site scripting almacenada. Un actor malicioso con privilegios para crear puntos de referencia personalizados podr\u00eda inyectar scripts para realizar acciones administrativas en VMware Aria Operations. Para remediar CVE-2026-22720, aplique los parches enumerados en la columna 'Fixed Version' de la 'Response Matrix' de VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// ."}], "id": "CVE-2026-22720", "lastModified": "2026-06-17T10:20:17.783", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "security@vmware.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22720", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T04:56:16.136372Z", "version": "2.0.3"}}]}, "published": "2026-02-25T20:23:47.077", "references": [{"source": "security@vmware.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947"}, {"source": "security@vmware.com", "tags": ["Release Notes"], "url": "https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@vmware.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.18.0,8.18.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "8.18.6"}}], "enrichment": {"confidence": 86.0, "confidence_source": "matching", "scores": [{"score": 86.0, "source": "matching"}]}, "original": {"product": "VMware Aria Operations", "source": "cna", "vendor": "VMware"}, "product": "aria_operations", "vendor": "vmware"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.0,5.2.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[9.0,9.0.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "9.0.2"}}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 87.0, "source": "matching"}]}, "original": {"product": "VMware Cloud Foundation", "source": "cna", "vendor": "VMware"}, "product": "cloud_foundation", "vendor": "vmware"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.0,5.2.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.2.3"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "VMware Telco Cloud Infrastructure", "source": "cna", "vendor": "VMware"}, "product": "telco_cloud_infrastructure", "vendor": "vmware"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.0,5.2.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.2.3"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "VMware Telco Cloud Platform", "source": "cna", "vendor": "VMware"}, "product": "telco_cloud_platform", "vendor": "vmware"}], "analysis": {"en": {"generated_at": "2026-04-15T15:11:54.647231+00:00", "value": {"mitigation_remediation": ["Apply the vendor patches for VMware Aria Operations 8.18.6 or newer and VMware Cloud Foundation Operations 9.0.2.0 or newer as listed in the VMSA-2026-0001 response matrix.", "Limit or revoke privileges that allow users to create custom benchmarks until the vulnerability is patched, reducing the opportunity for malicious script injection.", "If custom benchmark creation is required, enforce strict input validation and output encoding to prevent stored cross\u2011site scripting attacks."], "summary": {"action": "Patch", "impact": "Stored cross-site scripting allows execution of admin actions"}, "threat_synthesis": {"affected_systems": "The vulnerability affects several VMware products: VMware Aria Operations, VMware Cloud Foundation Operations, VMware Telco Cloud Infrastructure, and VMware Telco Cloud Platform. Versions lacking the security update are at risk; specifically, any Aria Operations installation before 8.18.6 and any Cloud Foundation Operations installation before 9.0.2.0 are vulnerable.", "description_and_impact": "VMware Aria Operations includes a stored cross\u2011site scripting flaw that permits a malicious actor who has permission to create custom benchmarks to insert malicious script into the benchmark data. When that stored script is rendered in the operations console, the attacker can run arbitrary JavaScript in the context of the application, enabling unauthorized administrative actions. This weakness, a classic stored XSS (CWE\u201179), threatens the integrity of the system and could lead to unauthorized configuration changes or privilege escalation within the Aria Operations platform.", "risk_and_exploitability": "CVSS v3.1 analyses place the severity at 8.0, indicating a high risk of exploitation. However, the EPSS score is below 1%, implying that the likelihood of active exploitation remains low. The vulnerability is not listed in CISA's KEV catalog. An attacker must possess the capability to create custom benchmarks, meaning the threat primarily targets users with elevated privileges. Once privilege to create benchmarks is present, the stored XSS can be leveraged to perform administrative actions within the affected VMware platform."}}}}, "created": "2026-02-26T13:14:56.198760+00:00", "updated": "2026-04-15T17:00:07.073209+00:00", "vendors": ["vmware", "vmware$PRODUCT$aria_operations", "vmware$PRODUCT$cloud_foundation", "vmware$PRODUCT$telco_cloud_infrastructure", "vmware$PRODUCT$telco_cloud_platform"]}