Vulnerabilities/VMware/CVE-2022-22954

CVE-2022-22954: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

CISA KEV entry · Last checked 30 Oct 2026, 12:10 UTC

Exploitation confirmedRansomware use knownFix: Unknown

CVSS 3.1 · NVD9.8Critical
EPSS100.0%100th percentile · 29 Oct 2026
CISA KEVListedAdded 14 Apr 2022

VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.

Recommended action

Apply updates per vendor instructions.

CISA due date 5 May 2022 · CWE-94

Vendor advisory ↗CISA KEV entry ↗

Am I affected?

ProductAffected versionsFixed in
VMware Workspace ONE Access and Identity ManagerAccess 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0. Identity Manager 3.3.6, 3.3.5, 3.3.4, 3.3.3.Unknown

No source states a fixed version. Check the vendor advisory below.

Before you patch

Restart

See vendor guidance.

Known issues

Check release notes.

Verification

Confirm installed version.

Timeline

  • 14 Apr 2022 · Added to CISA KEV
  • 5 May 2022 · CISA due date

References

Sources checked
CISA KEV30 Oct 2026, 12:10 UTC
CVE List v530 Oct 2026, 12:10 UTC
NVD30 Oct 2026, 12:10 UTC
FIRST EPSS30 Oct 2026, 12:11 UTC

Data from CISA, MITRE, NVD and FIRST. Sources and licences.