VMware Telco Cloud Platform vulnerabilities
5 known vulnerabilities in VMware Telco Cloud Platform from VMware. 5 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.0 High severity
VCF operations: Improper Neutralization of Input During Web Page Generation
VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Foundat
- 7.2 High severity
VMware Aria Operations: Improper Privilege Management
VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721,
- 9.0 Critical severity
VMware Aria Operations: Improper Neutralization of Input During Web Page Generation
VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, ap
- 7.8 High severity
Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Exploited
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploi
- 8.2 High severity
Vmware Aria Automation: Improper Neutralization of Input During Web Page Generation
VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a logged in user of VMware Aria automation appliance by tricking the user into clicking a malicious craf