CVE-2026-41722 is a high-severity vulnerability in VMware Cloud Foundation Operations involving multiple stored cross-site scripting flaws. An attacker with limited privileges (ability to create policies, views, or text-widgets) can inject malicious scripts that execute with administrative privileges, potentially compromising confidentiality, integrity, and availability of the system. The vulnerability affects multiple versions of the product (5.x, 9.0.x.x, 9.1.x.x). No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service, so remediation depends on VMware providing an update.

Successful exploitation could allow an attacker with limited privileges to escalate their control by executing arbitrary scripts with administrative capabilities. This could lead to full compromise of VMware Cloud Foundation Operations, impacting confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict privileges to create policies, views, or text-widgets to trusted administrators only to reduce risk.