CVE-2026-41723 is a set of stored cross-site scripting vulnerabilities in VMware Cloud Foundation Operations affecting versions 5.x, 9.0.x.x, and 9.1.x.x. An attacker with privileges to create certain content elements (policies, views, or text widgets) can inject malicious scripts that execute with administrative privileges within the application context. The vulnerability has a high CVSS score of 8.0, reflecting its potential to impact confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on VMware's future updates.

Successful exploitation could allow an attacker with limited privileges to execute arbitrary scripts in the context of VMware Cloud Foundation Operations, potentially leading to administrative actions being performed without authorization. This impacts confidentiality, integrity, and availability of the affected system. There are no reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the VMware advisory for current remediation guidance. Until a fix is available, restrict privileges to create policies, views, or text widgets to trusted administrators only. Monitor VMware's official channels for updates and apply patches promptly once released.