CVE-2022-22956: VMware Workspace ONE Access OAuth2 authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no privileges or user interaction required, an authentication bypass in an identity gateway, and a very high EPSS score make this an urgent patch target.

What it is

VMware Workspace ONE Access (and related Identity Manager and vRealize Automation deployments) contains an authentication bypass in the OAuth2 ACS framework, tracked alongside CVE-2022-22955. Exposed endpoints in the authentication framework let an actor skip authentication entirely, which matters because this component is the identity gateway for downstream enterprise applications.

Impact

An unauthenticated attacker can bypass authentication and execute arbitrary operations within the affected service, with CVSS 3.1 scoring confidentiality, integrity and availability all High. In an identity product this can mean forging or hijacking sessions and reaching systems that trust it.

Attack surface

Reached over the network via the exposed OAuth2 ACS endpoints; the CVSS vector shows no privileges required and no user interaction, so no valid credentials are needed. The description does not specify which exact endpoint or request sequence is abused.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is 0.498 (98.8th percentile) and public Packet Storm exploit write-ups exist, so exploitation is plausible and should be treated as likely. The record does not confirm in-the-wild attacks.

What to do

• Apply the vendor patch per VMware advisory VMSA-2022-0011 for Workspace ONE Access, Identity Manager and vRealize Automation.
• If patching cannot be immediate, restrict network access to the OAuth2 ACS and authentication endpoints to trusted sources only.
• Rotate credentials, session tokens and any secrets that may have been exposed through the affected authentication service.
• Review identity provider and SSO logs for anomalous token issuance or authentication events during the exposure window.

Detection

• Hunt for authentication or token-issuance events on Workspace ONE Access that lack a preceding valid login or come from unexpected source IPs.
• Monitor requests to OAuth2 ACS endpoints for unusual parameters, malformed assertions or repeated failures followed by success.
• Alert on new administrative accounts, role changes or configuration modifications in Workspace ONE Access outside change windows.
• Correlate downstream application access with the identity provider to spot sessions that were never legitimately authenticated.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.