VMWare Workspace ONE Access - RCE (CVE-2022-22954)

CVE-2022-22954 is a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager, stemming from server-side template injection. Attackers with network access can leverage this flaw to execute arbitrary code on vulnerable servers.

CrowdSec has been tracking this vulnerability and its exploits since 13th of April 2022.

CrowdSec network data shows that most actors exploiting CVE-2022-22954 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2022-22954 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2022-22954 is currently experiencing high visibility and active exploitation across the internet.

Detection patterns indicate that exploitation attempts typically involve requests to URLs containing /catalog-portal/ui/oauth/verify along with specific template injection strings.