CVE-2026-22720: VMware Aria Operations XSS Vulnerability

CVE-2026-22720 Overview

VMware Aria Operations contains a stored cross-site scripting (XSS) vulnerability that allows malicious actors with privileges to create custom benchmarks to inject malicious scripts. Once injected, these scripts can execute within the context of other users' sessions, potentially enabling attackers to perform administrative actions within the VMware Aria Operations environment.

Critical Impact

Authenticated attackers can inject persistent malicious scripts through custom benchmarks, potentially compromising administrative sessions and enabling unauthorized administrative actions across the VMware Aria Operations platform.

Affected Products

• VMware Aria Operations (versions prior to patched releases)
• VMware vRealize Operations (legacy naming)
• Broadcom VMware CIS Aria Operations Suite

Discovery Timeline

• 2026-02-25 - CVE-2026-22720 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-22720

Vulnerability Analysis

This stored cross-site scripting vulnerability (CWE-79) exists within VMware Aria Operations' custom benchmark creation functionality. Unlike reflected XSS attacks that require victims to click malicious links, stored XSS persists within the application's database. When legitimate users view the compromised benchmark data, the malicious script executes automatically within their browser context.

The attack requires the attacker to have authenticated access with privileges sufficient to create custom benchmarks. Once the malicious payload is stored, it can affect any user who subsequently views or interacts with the compromised benchmark, including administrators with elevated privileges. This creates a privilege escalation pathway where a lower-privileged user can potentially hijack administrative sessions.

Root Cause

The root cause stems from insufficient input validation and output encoding in the custom benchmark creation feature. When users create benchmarks, the application fails to properly sanitize script content before storing it in the database. Additionally, when benchmark data is rendered in the user interface, the application does not adequately encode the output, allowing stored scripts to execute in users' browsers.

This represents a failure to implement defense-in-depth principles where both input validation and output encoding should be applied. The CWE-79 classification indicates improper neutralization of input during web page generation.

Attack Vector

The attack follows a multi-stage exploitation pattern common to stored XSS vulnerabilities:

1. Initial Access: The attacker authenticates to VMware Aria Operations with an account that has permissions to create custom benchmarks
2. Payload Injection: The attacker crafts a malicious JavaScript payload and embeds it within benchmark configuration fields
3. Persistence: The malicious script is stored in the application's database without proper sanitization
4. Trigger: When other users, particularly administrators, view or interact with the benchmark, the script executes in their browser context
5. Exploitation: The script can then steal session tokens, modify application settings, create new administrative accounts, or perform other administrative actions

The network-based attack vector with low complexity makes this vulnerability particularly concerning in multi-user enterprise environments where VMware Aria Operations is used for infrastructure monitoring.

Detection Methods for CVE-2026-22720

Indicators of Compromise

• Unusual JavaScript code or HTML tags present in custom benchmark names, descriptions, or configuration fields
• Unexpected network requests originating from the VMware Aria Operations web interface to external domains
• Session tokens or authentication cookies being transmitted to unauthorized endpoints
• Newly created administrative accounts or privilege changes without corresponding authorized requests

Detection Strategies

• Implement Content Security Policy (CSP) headers and monitor for CSP violation reports indicating script injection attempts
• Review audit logs for custom benchmark creation and modification events, particularly those containing suspicious characters or encoded content
• Deploy web application firewall (WAF) rules to detect and block common XSS payload patterns in requests to benchmark endpoints
• Monitor browser console logs on administrative workstations for JavaScript errors that may indicate failed injection attempts

Monitoring Recommendations

• Enable detailed logging for all benchmark creation and modification operations within VMware Aria Operations
• Configure SIEM alerts for patterns consistent with XSS exploitation such as unusual cookie access or DOM manipulation
• Regularly audit custom benchmarks for unexpected or malicious content using automated scanning tools
• Monitor for unauthorized administrative actions that may indicate successful session hijacking

How to Mitigate CVE-2026-22720

Immediate Actions Required

• Apply the security patches referenced in VMSA-2026-0001 from Broadcom Security Advisory #36947
• Review and audit all existing custom benchmarks for potentially malicious content
• Restrict privileges for creating custom benchmarks to only essential personnel while patching is underway
• Implement strict Content Security Policy headers to mitigate the impact of any successful injection

Patch Information

Broadcom has released security patches addressing CVE-2026-22720. Organizations should apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' in VMSA-2026-0001. Refer to the Broadcom Security Advisory #36947 for specific version information and download links. Additional details are available in the Broadcom VMware Aria Operations Release Notes.

Workarounds

• Temporarily disable or restrict access to the custom benchmark creation feature until patches can be applied
• Implement additional input validation at the network perimeter using web application firewalls with XSS detection rules
• Review and reduce the number of accounts with benchmark creation privileges following the principle of least privilege
• Deploy browser-based XSS protection extensions on administrative workstations as an additional defense layer

# Example Content Security Policy configuration for web servers fronting VMware Aria Operations
# Add to your reverse proxy or load balancer configuration

# Apache configuration example
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"

# Nginx configuration example
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';" always;