Critical severity9.8CISA KEVNVD Advisory· Published Apr 11, 2022· Updated Jun 17, 2026
CVE-2022-22954
CVE-2022-22954
Description
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
14cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:*
- (no CPE)
- cpe:2.3:a:vmware:vrealize_automation:7.6:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:*:*:*:*:*:*:*:*Range: >=8.0,<=8.2
cpe:2.3:a:vmware:workspace_one_access:20.10.0.0:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:vmware:workspace_one_access:20.10.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:workspace_one_access:20.10.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:workspace_one_access:21.08.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:workspace_one_access:21.08.0.1:*:*:*:*:*:*:*
- (no CPE)
- VMware/Workspace ONE Access and Identity Managerdescription
Patches
Vulnerability mechanics
References
3- packetstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.htmlnvdExploitThird Party AdvisoryVDB Entry
- www.vmware.com/security/advisories/VMSA-2022-0011.htmlnvdVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
0No linked articles in our index yet.