CVE-2020-4006: VMware Workspace ONE Access and Identity Manager command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.1 critical severity, CISA KEV listing, and a high EPSS percentile indicate active exploitation risk in a sensitive identity component, though exploitation requires prior administrative access.

What it is

VMware Workspace ONE Access, Access Connector, Identity Manager, and Identity Manager Connector contain an OS command injection flaw (CWE-78). A remote attacker with administrative privileges can inject commands that execute on the affected appliance, which matters because these components sit in the identity and access path of an environment.

Impact

Successful exploitation lets the attacker run arbitrary commands on the underlying system with the privileges of the affected service, potentially leading to full compromise of the appliance and any credentials or trust relationships it holds.

Attack surface

Reachable over the network (AV:N) with no user interaction (UI:N), but the CVSS vector requires high privileges (PR:H), so the attacker must already hold an administrative account on the affected component. Scope is changed (S:C), meaning impact can extend beyond the vulnerable component.

Exploitation

CVE-2020-4006 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating exploitation in the wild; EPSS gives a 30-day probability of roughly 17.3 percent (96.9th percentile). No ransomware campaign use is documented in the record.

What to do

• Apply the vendor updates referenced in VMware advisory VMSA-2020-0027 as the primary fix.
• If immediate patching is not possible, restrict network access to the affected Workspace ONE Access, Identity Manager, and connector management interfaces.
• Audit and reduce the number of accounts with administrative privileges on these components, and enforce strong authentication for them.
• Monitor CISA KEV guidance and confirm remediation by the listed due date of 2022-05-03.
• Review the CERT/CC advisory VU#724367 for additional vendor guidance.

Detection

• Monitor appliance and host logs for unexpected child processes or shell invocations spawned by the affected services.
• Alert on command-injection patterns (shell metacharacters, encoded payloads) in requests to administrative endpoints of these components.
• Baseline and review administrative account activity, especially command execution or configuration changes outside normal change windows.
• Correlate outbound network connections from the affected appliances with known malicious infrastructure.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.