VMware Fixed Multiple Flaws Allow Attackers to Inject Malicious Scripts

Broadcom has revealed three stored cross-site scripting (XSS) flaws that affect VMware Cloud Foundation Operations and some other products. They warn that attackers who are logged in could add harmful scripts to do admin tasks in the system.

Tracked as CVE-2026-41722, CVE-2026-41723, and CVE-2026-41724, the issues were fixed in the security notice VMSA-2026-0004, released on June 8, 2026.

• Alert

Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction

By infosecbulletin / Saturday , November 7 2026

A major system failure has brought customer-facing banking services to a standstill at 128 shinkin banks across western Japan, leaving...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 06.11. 2026

By infosecbulletin / Friday , November 6 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Cyber Attack
• Hot Topic

Cyber attack causes French bank Credit Mutuel Arkea €100 million missing

By infosecbulletin / Friday , November 6 2026

French lender Credit Mutuel Arkea said on Thursday hackers had stolen around €100 million ($112.61 million) in a cyber heist...

Read More

• Hot Topic

OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours

By infosecbulletin / Thursday , November 5 2026

OpenAI says that an automated system found and confirmed 948 different Linux kernel security issues in one run. These flaws...

Read More

• National

Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw

By infosecbulletin / Thursday , November 5 2026

Apple credits Md Rasel Bhuyan and fellow researcher Musaab Khan for discovering an out-of-bounds write vulnerability affecting multiple Apple operating...

Read More

• Alert

WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild

By infosecbulletin / Wednesday , November 4 2026

A flaw in Zyxel GS1900 switches was being used by hackers, and the update to fix it did not work....

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 04.11. 2026

By infosecbulletin / Wednesday , November 4 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 03.11. 2026

By infosecbulletin / Tuesday , November 3 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Cyber Attack

Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries

By infosecbulletin / Tuesday , November 3 2026

Hackers used ARTEX, a free tool for testing security with AI, to attack over 200 organizations in 14 countries. The...

Read More

• Cyber Attack

Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines

By infosecbulletin / Monday , November 2 2026

A cybersecurity incident with Spanish travel tech company Amadeus IT Group has worried the global airline industry. Hackers got into...

Read More

VMware Stored XSS Vulnerabilities

VMware Cloud Foundation Operations has several stored cross-site scripting flaws caused by not properly checking user input.

Stored XSS is more dangerous than reflected XSS because the harmful code stays on the server and runs every time a victim opens the affected part, allowing repeated attacks on many users.

The flaws were shared privately with Broadcom by Alexis Bernazzani from Visa Inc. The notice covers many Broadcom virtualization products, such as VMware Aria Operations, VMware Cloud Foundation Operations, VMware Cloud Foundation, VMware vSphere Foundation, and VMware Telco Cloud Platform. Broadcom has put out fixes and updates that companies should use based on the Response Matrix.

Administrators should prioritize applying the listed fixed versions promptly, given the absence of any workaround.

Organizations should check who has roles and limit permissions for making policies, views, and text-widgets. This will reduce the number of accounts that can cause these problems while fixes are being applied.