CVE-2022-22960: VMware Workspace ONE Access and related products local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with public exploit code and high EPSS, but it requires an existing local low-privileged foothold rather than being remotely exploitable.

What it is

VMware Workspace ONE Access, Identity Manager, vRealize Automation and related products ship support scripts with incorrect permission assignments (CWE-732). A local attacker can abuse those permissions to escalate to root on the affected appliance. Because these appliances are identity and management control points, root compromise undermines the whole managed environment.

Impact

An attacker with an existing low-privileged local foothold gains full root control of the appliance, enabling credential theft, configuration tampering and lateral movement into managed systems.

Attack surface

Reached locally on the appliance; the CVSS vector AV:L/PR:L/UI:N means the attacker needs local access and low privileges but no user interaction. No remote or unauthenticated path is described in the record.

Exploitation

Listed in CISA KEV since 2022-04-15 with a 2022-05-06 remediation due date, and EPSS 30-day probability is about 0.358 (98th percentile). Public exploit references are tagged Exploit, so working exploit code is publicly available.

What to do

• Apply the vendor updates in VMware advisory VMSA-2022-0011 for all affected products (Workspace ONE Access, Identity Manager, vRealize Automation, vRealize Suite Lifecycle Manager, Cloud Foundation).
• If immediate patching is not possible, restrict local shell and SSH access to the affected appliances to trusted administrators only.
• Audit and correct permissions on vendor support scripts so they are not writable or abusable by low-privileged accounts.
• Monitor the KEV due date and confirm remediation is complete across every deployed instance, including appliances that are easy to overlook.
• Review appliance logs for unexpected privilege changes or root-level activity originating from non-admin accounts.

Detection

• Alert on processes running as root that were spawned by non-root service or support accounts on affected appliances.
• Monitor for writes or permission changes to vendor support scripts and their directories.
• Baseline and alert on new local accounts, SSH keys or sudoers changes on the appliances.
• Correlate local logins by low-privileged accounts with subsequent root-level command execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.