CVE-2022-22954: VMware Workspace ONE Access unauthenticated remote code execution
The short version: VMware Workspace ONE Access and Identity Manager have a server-side template injection flaw (CVE-2022-22954) that lets an unauthenticated attacker with network access execute code on the server. It scores a 9.8, it's in CISA's KEV catalog, and it was exploited in the wild shortly after disclosure. If you run an affected build reachable from the internet, this is patch-and-verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~99.99% · 99.99th percentile (2026-07-16) |
| In CISA KEV? | Yes — remediation was due 2022-05-05 |
| Known exploited? | Yes — exploited in the wild; associated with ransomware and coin-mining activity |
| Vulnerability type | CWE-94 code injection (server-side template injection) → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Workspace ONE Access 20.10–21.08 · Identity Manager 3.3.3–3.3.6 · vRealize Automation 7.6 & 8.0–8.6 · Cloud Foundation 4.x · vRealize Suite Lifecycle Manager 8.x |
| Fixed in | Per VMware advisory VMSA-2022-0011 (patches / hotfixes for each affected line) |
What you need to know
CVE-2022-22954 is a server-side template injection. A crafted request to the Workspace ONE Access / Identity Manager web interface is evaluated as a template on the server, and that evaluation becomes remote code execution — no login required.
This is about as bad as external exposure gets, and the role of the product makes it worse:
- It's the identity plane. Workspace ONE Access and Identity Manager broker authentication and single sign-on. Code execution there sits next to tokens, secrets, and the trust other systems place in the IdP.
- It's pre-authentication and internet-facing. These portals are meant to be reachable so users can sign in — no credential, no chain.
- It was live quickly. In-the-wild exploitation followed disclosure fast, with reports of web shells, ransomware, and cryptominers dropped through it — so an affected instance may have been touched.
How serious we see it
High — the 9.8 is earned here.
Unauthenticated, network-reachable code execution on an identity and single-sign-on server, confirmed exploited in the wild, is top-of-queue. The bounded, reassuring part is that it's specific and fixable: it affects named Workspace ONE Access / Identity Manager builds and the related vRealize/Cloud Foundation products, and VMware's fixes are published in VMSA-2022-0011. The catch is the one every exploited flaw shares — being patched and being clean are separate questions, so an instance exposed during the window deserves a look.
Recommendations
Straight from VMware's advisory (VMSA-2022-0011) and CISA:
- Patch now. Apply the fixes in VMSA-2022-0011 for your affected product and version.
- If you can't patch immediately, use VMware's documented workaround — then still schedule the patch.
- Hunt. Review the appliance for web shells and unexpected processes, and check logs for exploitation attempts against the affected endpoints.
- If you find indicators, respond fully. Rebuild the appliance and rotate credentials, tokens, and certificates — this is an identity component, so assume adjacent trust was exposed.
- Confirm your exposure first. Verify whether you run an affected Workspace ONE Access / Identity Manager build reachable from the internet at all.
How BreachRisk sees it
BreachRisk answers the first question — do we have an exposed, affected instance? — from the outside in. Starting from little more than your domain, it discovers internet-facing Workspace ONE / Identity Manager portals, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one, surfaced at the top of your results because it's in KEV.
That outside-in, continuous view is the whole point: when an identity-plane zero-day breaks, the exposed portal is already mapped, so you can go straight to patch-and-verify.