VMware Workspace ONE Access and Identity Manager Local Privilege Escalation (CVE-2022-22960) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTVMware Workspace ONE Access, Identity Manager (vIDM), and vRealize Automation (vRA).
A local attacker with low-privilege access can exploit improper permissions in support scripts to escalate privileges to root, leading to full system compromise.
Apply official security patches immediately in accordance with VMware Advisory VMSA-2022-0011.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official hotfix provided by VMware. Below is an example of downloading and executing the patch script on the virtual appliance.
# Download and extract the official patch package
wget https://kb.vmware.com/s/article/88097 -O HW-patch-instructions.zip
unzip HW-patch-instructions.zip
# Grant execution permissions and run the patch script
chmod +x applyPatch.sh
sudo ./applyPatch.sh2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict write access to the support scripts and ensure they are owned exclusively by the root user.
# Enforce strict ownership and permissions on support scripts
sudo chown root:root /usr/local/horizon/scripts/*
sudo chmod 755 /usr/local/horizon/scripts/*
# Restrict SSH access for non-essential local accounts
sudo usermod -s /sbin/nologin low_priv_user3. Log Audit & IoC Verification Commands
Use the following commands to audit the integrity of the support scripts and detect unauthorized modifications.
# Identify any support scripts modified within the last 7 days
find /usr/local/horizon/scripts/ -mtime -7 -ls
# Detect any scripts not owned by the root user or group
find /usr/local/horizon/scripts/ ! -user root -o ! -group rootBlock Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-22960) stems from improper permission settings (CWE-732) within the internal support scripts of VMware Workspace ONE Access, Identity Manager, and vRealize Automation. Structural flaws in the file system permissions allow non-administrative local users to modify critical scripts that are designed to be executed by high-privilege system processes.
2. Exploitation Mechanics & Attack Scenario
To exploit this vulnerability, an attacker must first establish local access with low-privilege user credentials on the target appliance. The attacker then identifies the vulnerable support scripts and overwrites them with malicious payloads. Because these scripts are periodically invoked by system cron jobs or system daemons running as root, the injected payload executes with root privileges, achieving Local Privilege Escalation (LPE).
3. Infrastructure & Business Impact
With a CVSS score of 7.8 and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses a severe threat. Successful exploitation allows attackers to compromise the identity provider infrastructure, harvest user credentials, pivot laterally across the enterprise network, and gain full control over virtualized environments.
Official Vendor Advisories & References
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.
Frequently Asked SecOps Questions (CVE-2022-22960)
FAQQ1. How critical is CVE-2022-22960 and is it actively exploited in the wild?
CVE-2022-22960 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 35.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-22960?
Primary impacted vendors include vmware across workspace_one_access, identity_manager, vrealize_automation. Scope summary: VMware Workspace ONE Access 21.08.0.1, 21.08.0.0, 20.10.0.1, 20.10.0.0; Identity Manager 3.3.6, 3.3.5, 3.3.4, 3.3.3; and vRealize Automation 8.x.
Q3. What temporary mitigations or workarounds exist for CVE-2022-22960 before patching?
[Mitigation] Apply official security patches immediately in accordance with VMware Advisory VMSA-2022-0011. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-22960
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (vmware)
View Category →Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)
[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).
VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
VMware Aria Operations Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-22719)
[Affected Scope] VMware Aria Operations instances with support-assisted product migration in progress
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.