CVE-2026-41724: VMware Cloud Foundation Operations XSS

CVE-2026-41724 Overview

CVE-2026-41724 affects VMware Cloud Foundation Operations, where multiple stored cross-site scripting (XSS) flaws exist in the policy, view, and text-widget creation features. An authenticated attacker holding privileges to create these objects can inject malicious scripts that execute in the browser of other users. When an administrator interacts with the injected content, the attacker can perform administrative actions in the platform context. The flaw is tracked under CWE-79 and documented in Broadcom Security Advisory #37513.

Critical Impact

Authenticated attackers can hijack administrator sessions and perform privileged operations within VMware Cloud Foundation Operations through stored script injection.

Affected Products

• VMware Cloud Foundation Operations (policy creation component)
• VMware Cloud Foundation Operations (view creation component)
• VMware Cloud Foundation Operations (text-widget component)

Discovery Timeline

• 2026-06-08 - CVE-2026-41724 published to NVD
• 2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-41724

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. VMware Cloud Foundation Operations fails to properly sanitize or encode user-supplied input in several object creation flows. Specifically, the policy, view, and text-widget features accept attacker-controlled content that is later rendered in the browsers of other users. Because the payload is persisted in backend storage, every subsequent visitor to the affected page receives the malicious script. The attack requires user interaction, meaning a privileged user must view the tainted object for execution to occur.

Root Cause

The root cause is improper neutralization of input during web page generation. Input fields for policies, dashboard views, and text widgets do not strip or escape HTML and JavaScript control characters before storing the content or rendering it back. The application treats user input as trusted markup rather than as data, allowing <script> tags and DOM event handlers to execute in the rendered context.

Attack Vector

The attack vector is network-based and requires low-level authenticated privileges sufficient to create policies, views, or text-widgets. The attacker injects a payload into a writable field of one of these objects. When an administrator later opens or views the resource, the script runs with the administrator's session privileges. The attacker can then invoke administrative API calls, modify configurations, or harvest session tokens. See Broadcom Security Advisory #37513 for vendor-specific exploitation context.

Detection Methods for CVE-2026-41724

Indicators of Compromise

• Policy, view, or text-widget objects containing <script> tags, javascript: URIs, or DOM event handler attributes such as onerror= or onload=.
• Unexpected administrative API calls originating from administrator browser sessions shortly after viewing dashboard content.
• New or modified user accounts, roles, or policy bindings created outside of approved change windows.

Detection Strategies

• Inspect stored policy, view, and text-widget records for HTML tags or JavaScript syntax that should not appear in legitimate configuration data.
• Correlate web application logs with audit logs to identify administrative actions that immediately follow a GET request to a user-generated dashboard object.
• Apply Content Security Policy (CSP) violation reporting where supported to surface inline script execution attempts.

Monitoring Recommendations

• Monitor the VMware Cloud Foundation Operations audit log for object creation and modification events by lower-privileged users.
• Alert on administrative session activity that occurs concurrently with the rendering of recently modified widgets or views.
• Ingest Cloud Foundation Operations logs into a centralized SIEM and apply detection rules for XSS payload patterns in stored fields.

How to Mitigate CVE-2026-41724

Immediate Actions Required

• Apply the patches listed in Broadcom Security Advisory #37513 to all VMware Cloud Foundation Operations instances.
• Audit existing policies, views, and text-widgets for previously injected payloads and remove any unauthorized content.
• Review and restrict the set of users granted permission to create policies, views, or text-widgets.

Patch Information

Broadcom has published remediation guidance in Security Advisory #37513. Administrators should consult the advisory for fixed version numbers and apply the vendor-supplied updates to all affected Cloud Foundation Operations deployments.

Workarounds

• Limit creation privileges for policies, views, and text-widgets to a small set of trusted accounts until patches are applied.
• Require administrators to access Cloud Foundation Operations from dedicated, hardened browsers without saved credentials or extensions.
• Enforce session timeouts and re-authentication for sensitive administrative operations to reduce the impact of session hijacking.

# Configuration example
# Consult Broadcom Security Advisory #37513 for vendor-specific patch and configuration commands.