Summary
Ein Angreifer kann mehrere Schwachstellen in VMware Aria Operations, VMware Cloud Foundation und VMware vSphere ausnutzen, um beliebigen Programmcode auszuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um seine Privilegien zu erhöhen.
Product
VMware Aria Operations bietet eine einheitliche Plattform für das IT-Betriebsmanagement in Private-, Hybrid- und Multi-Cloud-Umgebungen.
VMware Cloud Foundation ist eine Hybrid Cloud-Plattform für VM-Management und Container-Orchestrierung.
Die Virtualisierungssoftware von VMware ermöglicht die simultane Ausführung von verschiedenen Betriebssystemen auf einem Host-System.
Vulnerabilities 3
-
High 8.1
VMware Aria Operations command injection vulnerability
VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migratio…
KEV Mar 3, 2026 -
High 8.0
VMware Aria Operations stored cross-site scripting vulnerability
VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, …
-
Medium 6.2
VMware Aria Operations privilege escalation vulnerability
VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with privileges in vCenter to access Aria Operations may leverage this vulnerability to obtain administrative access in VMware Aria Operations. To remediate CVE-2026-22721…
Revision history
-
#3
Aktive Ausnutzung gemeldet
-
#2
Referenz(en) aufgenommen: EUVD-2026-8725, EUVD-2026-8708, EUVD-2026-8709
-
#1
Initiale Fassung
References
-
Broadcom Security Advisory vom 2026-02-23
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947
-
CISA Known Exploited Vulnerabilities Catalog vom 2026-03-03
https://www.cisa.gov/known-exploited-vulnerabilities-catalog