Attacker can inject malicious scripts through the UI of VMware Cloud Foundation Operations by creating policies, views, or text‑widgets. The stored cross‑site scripting flaw permits the injected code to run with the permissions of the logged‑in user, potentially allowing the attacker to perform privileged administrative actions such as modifying configurations or altering system settings.

The vulnerability affects VMware Cloud Foundation Operations, VMware Aria Operations, and VMware Telco Cloud Platform. No specific version information is provided in the advisory.

The CVSS score of 8.0 categorizes this flaw as high severity. Because EPSS data is not available, the exact likelihood of exploitation is unknown, but the flaw is not currently listed in the CISA KEV catalog. Attackers would need legitimate privileges to create policies or widgets, so the attack vector is via privileged user interaction with the application UI. Once the malicious script executes, it can cause a range of administrative abuses depending on the privileges of the account in use.