CVE-2026-22720 is a high severity stored cross site scripting flaw (CVSS 8.0) in VMware Aria Operations. A user who can create custom benchmarks may inject script that performs administrative actions. Apply the patches in the Fixed Version column of the VMSA-2026-0001 response matrix.
What's affected
VMware Aria Operations, and the products the record lists with it: VMware Cloud Foundation, Telco Cloud Infrastructure and Telco Cloud Platform.
The record gives no version numbers. It says to apply the patches in the Fixed Version column of the response matrix in Broadcom advisory VMSA-2026-0001. It also links the Aria Operations 8.18 release notes.
How to check if you're exposed
Find your Aria Operations version in the product interface, then open the VMSA-2026-0001 response matrix and find your product and version in it.
The matrix shows which version fixes the issue for each product line. Also list which accounts can create custom benchmarks, since the attack needs that permission.
What to do now
- Open advisory VMSA-2026-0001 and read the response matrix for your product.
- Apply the patch listed in the Fixed Version column and record the change.
- Review which users hold the privilege to create custom benchmarks, and trim the list.
- Look through existing custom benchmarks for unexpected content.
- Subscribe to Broadcom security advisories for the products you run.
Why it matters
The weakness is CWE-79, cross site scripting. In a stored case, the script is saved in the application and runs in the browser of whoever later views it. The record says a malicious actor with privileges to create custom benchmarks could inject script to perform administrative actions.
The vector shows low privileges and user interaction required, with high impact because the script can act with the rights of the administrator who views the page. Administrative consoles for monitoring tools are valuable targets for that reason.
The record does not say it is exploited in the wild, and it is not on the CISA KEV list. The fix is the vendor patch. Input handling and output encoding are the underlying controls.
Quick check
Who can exploit this?
A user with privileges to create custom benchmarks, per the record. An administrator then has to view the injected content.
Where are the fixed versions?
In the response matrix of Broadcom advisory VMSA-2026-0001. The record lists no version numbers.
Sources
Last reviewed: 19 October 2026.
