VMware · Workspace ONE Access and Identity Manager

CVE-2022-22954

VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: >99.9%

What it is

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

CISA: VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: May 5, 2022

Added to the CISA list: April 14, 2022
Published: April 11, 2022
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): >99.9% in the top 0.1% of all known vulnerabilities
Weakness: CWE-94
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from VMware

Added	Vulnerability	Product	Severity	Attack chance
Mar 4, 2025	TOCTOU Race ConditionCVE-2025-22224	ESXi and Workstation	Critical 9.3	1.6%
Mar 4, 2025	Arbitrary WriteCVE-2025-22225used by ransomware	ESXi	High 8.2	1.0%
Mar 4, 2025	Information DisclosureCVE-2025-22226	ESXi, Workstation, and Fusion	High 7.1	1.6%
Nov 20, 2024	Heap-Based Buffer OverflowCVE-2024-38812	vCenter Server	Critical 9.8	55%
Nov 20, 2024	Privilege EscalationCVE-2024-38813	vCenter Server	High 7.5	17%
Jul 30, 2024	Authentication BypassCVE-2024-37085used by ransomware	ESXi	Medium 6.8	27%
Jul 17, 2024	Incorrect Default File Permissions Vulnerability CVE-2022-22948	vCenter Server	Medium 6.5	13%
Jan 22, 2024	Out-of-Bounds WriteCVE-2023-34048	vCenter Server	Critical 9.8	99.2%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.