CVE-2022-22956
CVE-2022-22956
Vexday Risk Score
52Attention
SSVC decision (CISA)
Act
Exploitation + impact → act immediately
Exploit maturity
Functional exploit
Automatable exploit available (Nuclei/Metasploit).
CVSS —EPSS 50.7%KEV nãoPoC —Nuclei simMetasploit simPatch —
Lifecycle
06 Apr 2022Metasploit module available
13 Apr 2022Published on NVD
Recommendation: Patch as soon as possible — active exploitation confirmed.
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.
Affected products
n/a · VMware Workspace ONE Access