CVE-2024-38834: medium-severity vulnerability in VMware Aria Operations
Stored cross-site scripting vulnerability (CVE-2024-38834)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.3%
VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with editing access to cloud provider might be able to inject malicious script leading to stored cross-site scripting in the product VMware Aria Operations.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
Affected products
VMware · VMware Aria OperationsRelated CVEs — VMware Aria Operations
In the same product, most dangerous first.
CVE-2026-22719HIGHVMware Aria Operations command injection vulnerabilityEPSS 18.3%KEVCVE-2025-41244HIGHVMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)EPSS 8.6%KEVCVE-2026-22721MEDIUMVMware Aria Operations privilege escalation vulnerabilityEPSS 0.7%CVE-2025-41245MEDIUMVMSA-2025-0015: VMware Aria Operations and VMware Tools updates address multiple vulnerabilities (CVE-2025-41244,CVE-2025-41245, CVE-2025-41246)EPSS 0.6%CVE-2025-22222HIGHVMware Aria Operations information disclosure vulnerability (CVE-2025-22222)EPSS 0.6%CVE-2026-22720HIGHVMware Aria Operations stored cross-site scripting vulnerabilityEPSS 0.4%