CVE-2022-22954

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 100.00%
EPSS Percentile: 99.99%
CISA KEV: YES — Known Exploited Vulnerability

Description

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: security@vmware.com
Published: 12-Apr-2022 03:15
Last Modified: 17-Jun-2026 11:29
EPSS Date: 2026-10-20
CWE: CWE-94

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2022-04-14
Remediation Due: 2022-05-05
Known Ransomware Campaign Use: Known
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2022-22954

Affected Products / Versions

vmware / identity_manager
Version / affected range: 3.3.3
cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*
vmware / identity_manager
Version / affected range: 3.3.4
cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*
vmware / identity_manager
Version / affected range: 3.3.5
cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*
vmware / identity_manager
Version / affected range: 3.3.6
cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:*
vmware / vrealize_automation
Version / affected range: 7.6
cpe:2.3:a:vmware:vrealize_automation:7.6:*:*:*:*:*:*:*
vmware / workspace_one_access
Version / affected range: 20.10.0.0
cpe:2.3:a:vmware:workspace_one_access:20.10.0.0:*:*:*:*:*:*:*
vmware / workspace_one_access
Version / affected range: 20.10.0.1
cpe:2.3:a:vmware:workspace_one_access:20.10.0.1:*:*:*:*:*:*:*
vmware / workspace_one_access
Version / affected range: 21.08.0.0
cpe:2.3:a:vmware:workspace_one_access:21.08.0.0:*:*:*:*:*:*:*
vmware / workspace_one_access
Version / affected range: 21.08.0.1
cpe:2.3:a:vmware:workspace_one_access:21.08.0.1:*:*:*:*:*:*:*
vmware / cloud_foundation
Version / affected range: * · from (inclusive) 4.0 · through (inclusive) 4.3.1
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
vmware / vrealize_suite_lifecycle_manager
Version / affected range: * · from (inclusive) 8.0 · through (inclusive) 8.2
cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:*:*:*:*:*:*:*:*

References

Last enrichment sync: 21-Oct-2026 14:28
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

| | | | | | CVE-2022-22954 | | An unauthenticated attacker | | Microsoft Digital Defense Report 2026 Highlights AI-Accelerated Attacks and Agent Security Risks

CVE (4)

Malware (7)

People (4)

Threat Actors (2)

MITRE ATT&CK (15)

Vendors (1)

Products (10)

Industries (10)

Countries (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.