VMware Aria Operations includes a stored cross‑site scripting flaw that permits a malicious actor who has permission to create custom benchmarks to insert malicious script into the benchmark data. When that stored script is rendered in the operations console, the attacker can run arbitrary JavaScript in the context of the application, enabling unauthorized administrative actions. This weakness, a classic stored XSS (CWE‑79), threatens the integrity of the system and could lead to unauthorized configuration changes or privilege escalation within the Aria Operations platform.

The vulnerability affects several VMware products: VMware Aria Operations, VMware Cloud Foundation Operations, VMware Telco Cloud Infrastructure, and VMware Telco Cloud Platform. Versions lacking the security update are at risk; specifically, any Aria Operations installation before 8.18.6 and any Cloud Foundation Operations installation before 9.0.2.0 are vulnerable.

CVSS v3.1 analyses place the severity at 8.0, indicating a high risk of exploitation. However, the EPSS score is below 1%, implying that the likelihood of active exploitation remains low. The vulnerability is not listed in CISA's KEV catalog. An attacker must possess the capability to create custom benchmarks, meaning the threat primarily targets users with elevated privileges. Once privilege to create benchmarks is present, the stored XSS can be leveraged to perform administrative actions within the affected VMware platform.