PT-2026-21685 · Vmware · Vmware Aria Operations

Published 2026-02-24 · Updated 2026-03-04 · CVE-2026-22720

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Aria Operations (affected versions not specified)

Description VMware Aria Operations contains a stored cross-site scripting issue. An attacker with the ability to create custom benchmarks may inject script to perform administrative actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-02324

CVE-2026-22720

Affected Products

Vmware Aria Operations

References · 18

• https://osv.dev/vulnerability/CVE-2026-22720 · Vendor Advisory
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02324 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-22720 · Security Note
• https://twitter.com/exc_actual/status/2026583907286778084 · Twitter Post
• https://twitter.com/xkzdb/status/2028979090699538664 · Twitter Post
• https://twitter.com/xkzdb/status/2029072224431317031 · Twitter Post
• https://twitter.com/ThreatSynop/status/2026321482796638254 · Twitter Post
• https://t.me/cveNotify/154129 · Telegram Post
• https://twitter.com/CVEnew/status/2027099293782519919 · Twitter Post
• https://twitter.com/autumn_good_35/status/2026213607177179158 · Twitter Post
• https://twitter.com/ThreatSynop/status/2026322143290552469 · Twitter Post
• https://techdocs.broadcom.com/us/en/vmware-cis/aria/aria-operations/8-18/vmware-aria-operations-8186-release-notes.html · Note
• https://twitter.com/CCBalert/status/2026680789111366089 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1rkpf0g/cisa_flags_dangerous_vmware_flaw_cve202622719 · Reddit Post