What’s Vulnerable › Vulnerabilities

CVE-2022-22954: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-04-14
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-11 · updated 2026-06-17
• Weakness: CWE-94

Description

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

Affected products

• VMware Cloud Foundation: from 4.0 through 4.3.1
• VMware Identity Manager: 3.3.3, 3.3.4, 3.3.5, 3.3.6
• VMware vRealize Automation: 7.6
• VMware Vrealize Suite Lifecycle Manager: from 8.0 through 8.2
• VMware Workspace ONE Access: 20.10.0.0, 20.10.0.1, 21.08.0.0, 21.08.0.1
• VMware Workspace ONE Access and Identity Manager: Access 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0. Identity Manager 3.3.6, 3.3.5, 3.3.4, 3.3.3.

References

• http://packetstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.html
• https://www.vmware.com/security/advisories/VMSA-2022-0011.html
• http://packetstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.html
• https://www.vmware.com/security/advisories/VMSA-2022-0011.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22954

Get alerted when CVE-2022-22954 or the next vulnerability affects your stack