Stored XSS in VMware Aria Operations Custom Benchmarks

Successful exploitation can result in execution of attacker-controlled JavaScript in the context of the VMware Aria Operations web application, enabling session abuse and unauthorized actions performed with the victim user's privileges. In the scenario described by Broadcom, the practical impact is the ability to perform administrative actions in VMware Aria Operations when the stored payload is viewed or processed in an administrative context. This can lead to compromise of the management plane, unauthorized configuration changes, and potential follow-on access to data and operational controls exposed through Aria Operations.

No vendor workaround is listed for CVE-2026-22720. Until patching is completed, reduce exposure by strictly limiting the privilege to create custom benchmarks to only highly trusted administrators, reviewing and auditing existing custom benchmarks for injected script or unexpected content, monitoring benchmark creation and modification activity, and enforcing least-privilege RBAC to minimize the number of accounts capable of reaching the vulnerable functionality. These are exposure-reduction measures only and do not replace upgrading to a fixed version.

Apply the vendor fixes referenced in VMSA-2026-0001. The provided content states that VMware Aria Operations is fixed in version 8.18.6, and that related fixed releases include VMware Cloud Foundation 9.0.2.0 and VMware vSphere Foundation 9.0.2.0 where applicable. For other bundled product lines, apply the specific Broadcom KB-directed fixes identified in the advisory response matrix. Broadcom explicitly states that mitigation of CVE-2026-22720 requires upgrading to the latest fixed Aria Operations versions listed in the advisory.