CVE-2026-41724 identifies multiple stored cross-site scripting vulnerabilities in VMware Cloud Foundation Operations 5.x. An attacker with limited privileges to create certain UI elements (policies, views, text widgets) can inject malicious scripts. These scripts may execute administrative actions within the application context, potentially leading to full compromise of the affected system. The vulnerability is categorized as CWE-79 and carries a CVSS 3.1 base score of 8.0, reflecting high impact on confidentiality, integrity, and availability. No vendor advisory or patch is currently available, and the product is not a cloud service, so remediation is the responsibility of the user.

Successful exploitation of these stored XSS vulnerabilities can allow an attacker with limited privileges to escalate their control by executing arbitrary scripts in the context of VMware Cloud Foundation Operations. This can lead to unauthorized administrative actions, compromising confidentiality, integrity, and availability of the system. The CVSS vector indicates network attack vector, low attack complexity, privileges required, user interaction required, and high impact on all security properties.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, restrict privileges to create policies, views, or text widgets to trusted administrators only. Monitor VMware's security advisories for updates and apply patches promptly once available.