CVE-2026-22720

⚠️ high

Summary

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// .

CVSS Score

8.0

High

EPSS Score

0.1

Exploit Probability

Published Date

2026-02-25

First Seen: 2026-02-26

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 77.8% of all 318,332 vulnerabilities in our database.

#70,521

Top 25% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Feb 26, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2026-03-04

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-79

📦 Affected Products 5

Vendor	Product	Status	Affected Versions
vmware	cloud_foundation	Affected	> 4.0 < 5.2.3
vmware	cloud_foundation	Affected	> 9.0 < 9.0.2.0
vmware	aria_operations	Affected	> 8.0 < 8.18.6
vmware	telco_cloud_platform	Affected	> 4.0 < 5.1
vmware	telco_cloud_infrastructure	Affected	> 2.2 < 3.0

🔗 References 2

https://support.broadcom.com/web/ecx/support-content...

Patch Vendor Advisory

https://techdocs.broadcom.com/us/en/vmware-cis/aria/...

Release Notes

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-22719	⚠️ high	8.1	7.4	VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this is...	2026-02-25
CVE-2026-22721	🔶 medium	6.2	0.1	VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to ac...	2026-02-25
CVE-2025-41244	⚠️ high	7.8	1.0	VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor wit...	2025-09-29
CVE-2025-41250	⚠️ high	8.5	0.1	VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on...	2025-09-29
CVE-2025-41241	🔶 medium	4.4	0.1	VMware vCenter contains a denial-of-service vulnerability. A malicious actor who is authenticated through vCenter and h...	2025-07-29
CVE-2025-41236	⛔ critical	9.3	0.0	VMware ESXi, Workstation, and Fusion contain an integer-overflow vulnerability in the VMXNET3 virtual network adapter. ...	2025-07-15

These CVEs affect the same products