VCF operations vulnerabilities

2 known vulnerabilities in VCF operations from VMware. 2 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.0 High severity

  VCF operations: Improper Neutralization of Input During Web Page Generation

  CVE-2026-41723Jun 8, 2026VMware

  VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundat

• 7.8 High severity

  Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Exploited

  CVE-2025-41244Sep 29, 2025VMwareEPSS 16.4%

  VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploi