How severe is CVE-2022-22954?

CVE-2022-22954 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2022-22954 being actively exploited?

Yes. CVE-2022-22954 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2022-04-14, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2022-22954?

CVE-2022-22954 primarily affects Vmware Identity Manager. In total, 11 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-22954?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2022-22954 have an EU (EUVD) identifier?

Yes. CVE-2022-22954 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2022-28077. It is also flagged as exploited in the EUVD (since 2022-04-14).

When was CVE-2022-22954 published?

CVE-2022-22954 was published on 2022-04-11 and last updated on 2026-06-17.

CVE-2022-22954

CVE-2022-22954 is a critical-severity vulnerability in Vmware Identity Manager with a CVSS 3.x base score of 9.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2022-04-14). The underlying weakness is classified as CWE-94.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 10.0
EPSS exploit prediction: 100% (100th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2022-04-14)
EU (EUVD) id: EUVD-2022-28077
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2022-04-14)
Weakness: CWE-94
Affected product: Vmware Identity Manager
Published: 2022-04-11
Last modified: 2026-06-17

Description

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.

Frequently asked questions

What is CVE-2022-22954?: VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
How severe is CVE-2022-22954?: CVE-2022-22954 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2022-22954 being actively exploited?: Yes. CVE-2022-22954 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2022-04-14, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2022-22954?: CVE-2022-22954 primarily affects Vmware Identity Manager. In total, 11 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-22954?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2022-22954 have an EU (EUVD) identifier?: Yes. CVE-2022-22954 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2022-28077. It is also flagged as exploited in the EUVD (since 2022-04-14).
When was CVE-2022-22954 published?: CVE-2022-22954 was published on 2022-04-11 and last updated on 2026-06-17.

References

Affected products (11)

cpe:2.3:a:vmware:identity_manager:3.3.3:*:*:*:*:*:*:*
cpe:2.3:a:vmware:identity_manager:3.3.4:*:*:*:*:*:*:*
cpe:2.3:a:vmware:identity_manager:3.3.5:*:*:*:*:*:*:*
cpe:2.3:a:vmware:identity_manager:3.3.6:*:*:*:*:*:*:*
cpe:2.3:a:vmware:vrealize_automation:7.6:*:*:*:*:*:*:*
cpe:2.3:a:vmware:workspace_one_access:20.10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:vmware:workspace_one_access:20.10.0.1:*:*:*:*:*:*:*
cpe:2.3:a:vmware:workspace_one_access:21.08.0.0:*:*:*:*:*:*:*
cpe:2.3:a:vmware:workspace_one_access:21.08.0.1:*:*:*:*:*:*:*
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:*
cpe:2.3:a:vmware:vrealize_suite_lifecycle_manager:*:*:*:*:*:*:*:*

More vulnerabilities in Vmware Identity Manager

CVE-2022-31657 — Critical (CVSS 9.8): VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. A malicious actor with network…
CVE-2022-31656 — Critical (CVSS 9.8): VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability…
CVE-2022-22972 — Critical (CVSS 9.8): VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability…
CVE-2022-22956 — Critical (CVSS 9.8): VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the…
CVE-2022-22955 — Critical (CVSS 9.8): VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the…
CVE-2021-22002 — Critical (CVSS 9.8): VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be…

All CVEs affecting Vmware Identity Manager →

Other CWE-94 (Code Injection) vulnerabilities

CVE-2026-76605 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.3 - ???.
CVE-2026-76604 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.3 - The…
CVE-2026-67364 — Critical (CVSS 10.0): Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1:…
CVE-2026-73343 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
CVE-2026-74253 — Critical (CVSS 10.0): Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 14.0.0…
CVE-2026-73678 — Critical (CVSS 10.0): MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that…

Browse all CWE-94 (Code Injection) vulnerabilities →