VMware Workspace ONE Access and Identity Manager Server-Side Template Injection (SSTI) Remote Code Execution Vulnerability (CVE-2022-22954) Analysis and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTSpecific versions of VMware Workspace ONE Access and Identity Manager
Unauthenticated remote attackers with network access can execute arbitrary system commands on the target server, posing a critical risk (CVSS 9.8)
Immediately apply the official security patches (VMSA-2022-0011) or implement temporary workarounds to restrict external access
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official hotfixes provided by VMware in the VMSA-2022-0011 advisory. Below is an example of downloading and applying the patch on a Linux-based appliance.
# 1. Download the official patch package
curl -L -O 'https://kb.vmware.com/s/article/88099?file=HW-vRealize-Suite-Lifecycle-Manager-8.x-Appliance-Patches.zip'
unzip HW-vRealize-Suite-Lifecycle-Manager-8.x-Appliance-Patches.zip
# 2. Grant execution permissions and run the patch script
chmod +x patch.sh
sudo ./patch.sh2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the vulnerable endpoints using a reverse proxy or Web Application Firewall (WAF).
# Nginx configuration to block external access to the vulnerable endpoint
server {
listen 443 ssl;
server_name workspace.company.com;
location ~* /catalog-portal/ui/oauth/signin {
deny all;
return 403;
}
}3. Log Audit & IoC Verification Commands
Inspect the application logs for indicators of compromise (IoCs) such as Freemarker template injection payloads or unexpected command executions.
# 1. Search for SSTI payloads and Java runtime execution patterns in logs
grep -Ei 'freemarker|exec|java.lang.Runtime|ProcessBuilder' /opt/vmware/horizon/workspace/logs/horizon.log
# 2. Verify the installed package version
rpm -qa | grep -i 'identity-manager'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-22954) is a Server-Side Template Injection (SSTI) flaw in VMware Workspace ONE Access and Identity Manager. The root cause lies in the improper validation of user-supplied input before passing it to the Freemarker template engine within specific web endpoints. This allows an attacker to inject malicious template directives that are subsequently executed by the server.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker can send a crafted HTTP request to vulnerable endpoints (such as /catalog-portal/ui/oauth/signin) containing Freemarker template syntax (${...}) in the parameters. When the server processes and renders the template, it evaluates the injected expression, allowing the attacker to instantiate Java classes and execute arbitrary OS commands under the privileges of the web server process.
3. Infrastructure & Business Impact
With a CVSS score of 9.8, this vulnerability is classified as Critical and is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV catalog. Successful exploitation can lead to complete system compromise, lateral movement within the internal network, data exfiltration, and deployment of ransomware, resulting in severe business disruption.
Official Vendor Advisories & References
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
Frequently Asked SecOps Questions (CVE-2022-22954)
FAQQ1. How critical is CVE-2022-22954 and is it actively exploited in the wild?
CVE-2022-22954 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-22954?
Primary impacted vendors include vmware across workspace_one_access, identity_manager. Scope summary: VMware Workspace ONE Access 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0, and Identity Manager 3.3.6, 3.3.5, 3.3.4, 3.3.3 (Refer to VMSA-2022-0011)
Q3. What temporary mitigations or workarounds exist for CVE-2022-22954 before patching?
[Mitigation] Immediately apply the official security patches (VMSA-2022-0011) or implement temporary workarounds to restrict external access Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-22954
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (vmware)
View Category →VMware Aria Operations Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-22719)
[Affected Scope] VMware Aria Operations instances with support-assisted product migration in progress
Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)
[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).
VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.