VMware Cloud Foundation Operations suffers from stored cross‑site scripting. A threat actor who can create policies, views or text‑widgets can insert malicious script; when the script runs in the administrator's browser it can perform privileged actions. Based on the description, it is inferred that the flaw may allow an attacker with such privileges to override normal authorization checks and could lead to unauthorized configuration changes or data exposure.

The affected products are VMware Cloud Foundation Operations, VMware Aria Operations, and VMware Telco Cloud Platform. No specific version numbers are listed in the advisory, so all current installations of these products should be considered vulnerable until a fix is applied.

With a CVSS score of 8, this vulnerability presents a high severity risk. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to possess the ability to create policies, views or text‑widgets – privileges that are typically granted only to administrators or users with elevated rights. Once the script is executed in the context of an authenticated user, it can trigger administrative actions without additional authentication.