CVERadar
CRITICAL · CVSS 3.1 9.8CISA KEV · added 2022-04-14Metasploit modulePublic PoCKnown ransomware useEPSS 100.00% (p100)Threat level 99

CVE-2022-22954: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

VMware · Workspace ONE Access and Identity Manager · NVD published 2022-04-12 · posted 2026-10-21 · last modified 2026-06-17

What it is

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

WeaknessCWE-94
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (source: [email protected])
CISA due date2022-05-05 (for US federal agencies under BOD; a good deadline for everyone)
ATT&CK tacticsPersistence → Stealth

Exploitation evidence

First exploit evidence seen: 2022-04-06 (earliest date across the sources below).

Exploited in the wild

  • CISA KEV: listed since 2022-04-14. Source

Public exploit code

Metasploit

GitHub proof-of-concept repositories

26 public repositories from 25 accounts, first seen 2022-04-11. Most starred: Schira4396/VcenterKiller (1482 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: CISA KEV · Rapid7 Metasploit Framework module metadata · nomi-sec/PoC-in-GitHub.

Defend the Chain

The attack chain for CVE-2022-22954 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.

Threat level 99/100
Defender level 1 · 0 XP
Chain links broken: 0/2

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Stealth

Defense Impairment

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Pick a red technique card on the board, then choose the defence that stops it.

Defend against T1505.003 Web Shell CTID: primary impact

This vulnerability is exploited via server-side template injection to achieve remote code execution. This access is then used to establish backdoors. Adversaries have been observed chaining this with CVE-2022-22960 in order to escalate privileges to root.

How to fix it

CISA required action

Apply updates per vendor instructions. (source: CISA KEV)

Fixed versions

  • vmware cloud foundation: versions up to and including 4.3.1 are affected; check the vendor advisory for the fixed release.
  • vmware vrealize suite lifecycle manager: versions up to and including 8.2 are affected; check the vendor advisory for the fixed release.

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

MITRE ATT&CK mitigations for this chain

  • M1042 Disable or Remove Feature or Program (for T1505.003, T1221) : Consider disabling functions from web technologies such as PHP’s `evaI()` that may be abused for web shells.
  • M1018 User Account Management (for T1505.003) : Enforce the principle of least privilege by limiting privileges of user accounts so only authorized accounts can modify the web directory.
  • M1049 Antivirus/Antimalware (for T1221) : Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.
  • M1031 Network Intrusion Prevention (for T1221) : Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.
  • M1017 User Training (for T1221) : Train users to identify social engineering techniques and spearphishing emails that could be used to deliver malicious documents.

Detection Generic guidance

  • Persistence: Look for new files in web roots, new scheduled tasks/services, and new accounts created after the exposure window.

Response checklist Generic guidance

  1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
  2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
  3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
  4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.

Sources