Remote Code Execution Vulnerability in VMware Workspace ONE Access

• •CVE-2022-22954 allows RCE via SSTI in VMware products.
• •PoC code is publicly available, raising exploitation risk.
• •Organizations using affected VMware services must act quickly.

A critical remote code execution (RCE) vulnerability, CVE-2022-22954, affects VMware Workspace ONE Access and Identity Manager through server-side template injection (SSTI). The vulnerability was first published on April 11, 2022, and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on April 14, 2022. Recent proof-of-concept (PoC) code has been released, allowing attackers to exploit this vulnerability. The PoC code enables attackers to execute arbitrary commands on affected systems by leveraging specific queries on services like Shodan and Zoomeye. Security professionals are advised to avoid using this PoC in production environments. The vulnerability has been confirmed to impact numerous organizations using the affected VMware products. As of now, the exploit is publicly available, increasing the urgency for organizations to assess their exposure and apply necessary mitigations.