VMware Workspace ONE Access - RCE (CVE-2022-22954)

CVE-2022-22954 is a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager, stemming from server-side template injection. Attackers with network access can leverage this flaw to execute arbitrary code on vulnerable servers.

CrowdSec has been tracking this vulnerability and its exploits since 13th of April 2022.

CrowdSec network data shows that most actors exploiting CVE-2022-22954 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2022-22954 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Detection patterns indicate that exploitation attempts typically involve requests to URLs containing /catalog-portal/ui/oauth/verify along with specific template injection strings.