VMware Cloud Foundation Operations vulnerabilities

2 known vulnerabilities in VMware Cloud Foundation Operations from VMware. 2 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.0 Critical severity

  VMware Aria Operations: Improper Neutralization of Input During Web Page Generation

  CVE-2026-22720Feb 25, 2026VMware

  VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, ap

• 8.1 High severity

  Broadcom VMware Aria Operations Command Injection Exploited

  CVE-2026-22719Feb 25, 2026VMwareEPSS 18.3%

  VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration