What is CVE-2026-22720?
VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. To remediate CVE-2026-22720, apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' of VMSA-2026-0001 https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947https:// .
The record classifies CVE-2026-22720 under weakness class CWE-79. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs low-privilege credentials, needs a user to take an action first, and has high impact on confidentiality, integrity, availability. 4 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 222 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 8 — HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - EPSS (FIRST)
- 0.1% probability of exploitation in the next 30 days, higher than 29.0% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 5.2/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2026-02-25, last modified 2026-03-04
Is CVE-2026-22720 being exploited?
It currently carries a trending score of 12 in the Threadlinqs vulnerability feed.
Affected products and versions
- Vmware: Aria Operations, Cloud Foundation, Telco Cloud Infrastructure, Telco Cloud Platform
How to fix CVE-2026-22720
The record marks a vendor fix as available for CVE-2026-22720. Vendor advisory: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.
Threat activity tracking CVE-2026-22720
1 tracked threat in the Threadlinqs corpus references CVE-2026-22720, either in the campaign’s CVE list or as an indicator on the campaign record.
Sources
Seeded from threadlinqs-intel and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.