{"id":"CVE-2022-22954","aliases":["EUVD-2022-28077","GHSA-q7xc-35g4-g566"],"status":"published","title":"VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability...","description":"VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.99998,"percentile":0.9999,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-94"],"published":"2022-04-11T19:37:39Z","modified":"2026-06-17T04:29:14Z","kev":{"date_added":"2022-04-14","due_date":"2022-05-05","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-04-14"},{"source":"kev","since":"2022-04-14"}],"exploits":[{"source":"pocgithub","id":"axingde/CVE-2022-22954-POC","title":"axingde/CVE-2022-22954-POC","date":"2020-10-09","url":"https://github.com/axingde/CVE-2022-22954-POC"},{"source":"metasploit","id":"exploit/linux/http/vmware_workspace_one_access_cve_2022_22954","title":"VMware Workspace ONE Access CVE-2022-22954","type":"exploit","platform":"Linux,Unix","date":"2022-04-06","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/vmware_workspace_one_access_cve_2022_22954"},{"source":"pocgithub","id":"Vulnmachines/VMWare_CVE-2022-22954","title":"Vulnmachines/VMWare_CVE-2022-22954","date":"2022-04-11","url":"https://github.com/Vulnmachines/VMWare_CVE-2022-22954"},{"source":"pocgithub","id":"aniqfakhrul/CVE-2022-22954","title":"aniqfakhrul/CVE-2022-22954","date":"2022-04-11","url":"https://github.com/aniqfakhrul/CVE-2022-22954"},{"source":"pocgithub","id":"sherlocksecurity/VMware-CVE-2022-22954","title":"sherlocksecurity/VMware-CVE-2022-22954","date":"2022-04-11","url":"https://github.com/sherlocksecurity/VMware-CVE-2022-22954"},{"source":"pocgithub","id":"DrorDvash/CVE-2022-22954_VMware_PoC","title":"DrorDvash/CVE-2022-22954_VMware_PoC","date":"2022-04-12","url":"https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC"},{"source":"pocgithub","id":"MSeymenD/CVE-2022-22954-Testi","title":"MSeymenD/CVE-2022-22954-Testi","date":"2022-04-12","url":"https://github.com/MSeymenD/CVE-2022-22954-Testi"},{"source":"pocgithub","id":"corelight/cve-2022-22954","title":"corelight/cve-2022-22954","date":"2022-04-12","url":"https://github.com/corelight/cve-2022-22954"},{"source":"pocgithub","id":"jax7sec/CVE-2022-22954","title":"jax7sec/CVE-2022-22954","date":"2022-04-12","url":"https://github.com/jax7sec/CVE-2022-22954"},{"source":"pocgithub","id":"lucksec/VMware-CVE-2022-22954","title":"lucksec/VMware-CVE-2022-22954","date":"2022-04-12","url":"https://github.com/lucksec/VMware-CVE-2022-22954"},{"source":"pocgithub","id":"mumu2020629/-CVE-2022-22954-scanner","title":"mumu2020629/-CVE-2022-22954-scanner","date":"2022-04-12","url":"https://github.com/mumu2020629/-CVE-2022-22954-scanner"},{"source":"pocgithub","id":"Jun-5heng/CVE-2022-22954","title":"Jun-5heng/CVE-2022-22954","date":"2022-04-13","url":"https://github.com/Jun-5heng/CVE-2022-22954"},{"source":"pocgithub","id":"bewhale/CVE-2022-22954","title":"bewhale/CVE-2022-22954","date":"2022-04-13","url":"https://github.com/bewhale/CVE-2022-22954"},{"source":"pocgithub","id":"tunelko/CVE-2022-22954-PoC","title":"tunelko/CVE-2022-22954-PoC","date":"2022-04-13","url":"https://github.com/tunelko/CVE-2022-22954-PoC"},{"source":"pocgithub","id":"emilyastranova/VMware-CVE-2022-22954-Command-Injector","title":"emilyastranova/VMware-CVE-2022-22954-Command-Injector","date":"2022-04-14","url":"https://github.com/emilyastranova/VMware-CVE-2022-22954-Command-Injector"},{"source":"pocgithub","id":"MLX15/CVE-2022-22954","title":"MLX15/CVE-2022-22954","date":"2022-04-15","url":"https://github.com/MLX15/CVE-2022-22954"},{"source":"pocgithub","id":"mhurts/CVE-2022-22954-POC","title":"mhurts/CVE-2022-22954-POC","date":"2022-04-16","url":"https://github.com/mhurts/CVE-2022-22954-POC"},{"source":"pocgithub","id":"nguyenv1nK/CVE-2022-22954","title":"nguyenv1nK/CVE-2022-22954","date":"2022-05-05","url":"https://github.com/nguyenv1nK/CVE-2022-22954"},{"source":"pocgithub","id":"Chocapikk/CVE-2022-22954","title":"Chocapikk/CVE-2022-22954","date":"2022-06-01","url":"https://github.com/Chocapikk/CVE-2022-22954"},{"source":"pocgithub","id":"secfb/CVE-2022-22954","title":"secfb/CVE-2022-22954","date":"2022-06-01","url":"https://github.com/secfb/CVE-2022-22954"},{"source":"pocgithub","id":"b4dboy17/CVE-2022-22954","title":"b4dboy17/CVE-2022-22954","date":"2022-06-03","url":"https://github.com/b4dboy17/CVE-2022-22954"},{"source":"pocgithub","id":"orwagodfather/CVE-2022-22954","title":"orwagodfather/CVE-2022-22954","date":"2022-06-03","url":"https://github.com/orwagodfather/CVE-2022-22954"},{"source":"pocgithub","id":"arzuozkan/CVE-2022-22954","title":"arzuozkan/CVE-2022-22954","date":"2022-06-11","url":"https://github.com/arzuozkan/CVE-2022-22954"},{"source":"pocgithub","id":"amit-pathak009/CVE-2022-22954","title":"amit-pathak009/CVE-2022-22954","date":"2022-08-13","url":"https://github.com/amit-pathak009/CVE-2022-22954"},{"source":"pocgithub","id":"amit-pathak009/CVE-2022-22954-PoC","title":"amit-pathak009/CVE-2022-22954-PoC","date":"2022-08-13","url":"https://github.com/amit-pathak009/CVE-2022-22954-PoC"},{"source":"pocgithub","id":"Schira4396/VcenterKiller","title":"Schira4396/VcenterKiller","date":"2022-10-04","url":"https://github.com/Schira4396/VcenterKiller"},{"source":"nuclei","id":"CVE-2022-22954","title":"VMware Workspace ONE Access - Server-Side Template Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22954.yaml"}],"exploits_more":1,"products":[{"vendor":"vmware","product":"cloud_foundation"},{"vendor":"vmware","product":"identity_manager"},{"vendor":"vmware","product":"vrealize_automation"},{"vendor":"vmware","product":"vrealize_suite_lifecycle_manager"},{"vendor":"vmware","product":"workspace one access and identity manager"},{"vendor":"vmware","product":"workspace_one_access"}],"references":[{"url":"https://www.vmware.com/security/advisories/VMSA-2022-0011.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/166935/VMware-Workspace-ONE-Access-Template-Injection-Command-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22954","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22954"},{"url":"https://github.com/advisories/GHSA-q7xc-35g4-g566"}],"sources":{"cve":[{"id":"CVE-2022-22954","description":"VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.","status":"published","published":"2022-04-11T19:37:39Z","modified":"2025-10-21T23:15:42.493Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:26.645563Z"}],"euvd":[{"id":"EUVD-2022-28077","description":"VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.","status":"published","published":"2022-04-11T19:37:39Z","modified":"2025-10-21T23:15:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-04-14","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-q7xc-35g4-g566","title":"VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability...","description":"VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.","status":"published","published":"2022-04-12T00:00:29Z","modified":"2025-10-22T00:33:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:04:08.198655Z"}],"kev":[{"id":"CVE-2022-22954","title":"VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability","description":"VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.","cwes":["CWE-94"],"kev":{"date_added":"2022-04-14","due_date":"2022-05-05","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2022-22954","description":"VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.","status":"published","published":"2022-04-11T20:15:19.89Z","modified":"2026-06-17T04:29:14.263Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:15.414503Z"}]}}