CVE-2022-22957
CVE-2022-22957
Vexday Risk Score
45Attention
SSVC decision (CISA)
Act
Exploitation + impact → act immediately
Exploit maturity
Functional exploit
Automatable exploit available (Nuclei/Metasploit).
CVSS —EPSS 23.1%KEV nãoPoC —Nuclei —Metasploit simPatch —
Lifecycle
06 Apr 2022Metasploit module available
13 Apr 2022Published on NVD
Recommendation: Patch as soon as possible — active exploitation confirmed.
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.