CVE-2022-22954: VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

CVE-2022-22954 is a server-side template injection flaw in VMware Workspace ONE Access and Identity Manager that can allow remote code execution. CISA notes that this vulnerability has been used by ransomware operators, so organizations running these identity products should treat it as a high-priority risk to authentication and access infrastructure.

Because these components often sit at the front of enterprise single sign-on and identity workflows, successful exploitation can give an attacker a foothold with broad reach. Confirm exact affected builds and fixed releases against the vendor advisory before acting.

How it works

The weakness is classified as CWE-94 (improper control of code generation). In products that render server-side templates, user-controlled input is sometimes passed into a template engine without adequate sanitization or sandboxing. An attacker who can supply crafted template expressions may cause the engine to evaluate them on the server, leading to arbitrary code execution in the context of the application process.

For VMware Workspace ONE Access and Identity Manager, CISA summarizes the issue simply: the products allow remote code execution due to server-side template injection. Public detail beyond that class of abuse is limited here; do not assume specific request parameters, endpoints, or payloads. Treat any unauthenticated or low-privilege ability to influence template rendering as the core risk and verify exploitation prerequisites only from the vendor advisory and your own testing in a lab.

Am I affected? How to find it in your systems

Workspace ONE Access and Identity Manager are typically deployed as appliances or services that provide identity federation, catalog access, and authentication for VMware and third-party applications. They often run in DMZs or identity zones and may be reachable from the internet or broad internal networks.

• Inventory: Search configuration management, hypervisor inventories, and network scans for hosts or virtual appliances identified as Workspace ONE Access or VMware Identity Manager. Check management consoles, certificate common names, and service banners where available.
• Version and configuration: Compare installed builds against the affected ranges listed in the vendor advisory. Note any internet-facing interfaces, reverse proxies, or custom template-related settings.
• Telemetry: Review web and application logs for anomalous requests that contain template-like syntax, unexpected errors from the template engine, or sudden process spawns and outbound connections from the identity service account. Endpoint detection on the appliance (if supported) may show unusual child processes. Confirm log locations and indicators with vendor documentation.

If you cannot determine the exact build, assume potential exposure until you verify otherwise.

How to remediate

Patch first. CISA’s required action is to apply updates per vendor instructions. Obtain the fixed packages or appliance updates named in VMware’s advisory for Workspace ONE Access and Identity Manager, stage them in a test environment, then deploy to production with normal change control.

• After patching, restart services as directed and confirm the new version string.
• Rotate any credentials or secrets that resided on the affected systems if you suspect prior compromise.
• Harden the identity tier: restrict management interfaces to jump hosts, enforce least-privilege service accounts, and keep the appliances under continuous configuration monitoring.
• Re-validate authentication flows and integrations after the update to ensure no regressions.

Do not rely on workarounds as a substitute for the vendor fix when the patch is available.

If you can't patch immediately

Reduce exposure until you can update:

• Segmentation: Place the appliances behind strict network controls so only required clients and proxies can reach the application ports. Block direct internet access if business needs allow.
• Virtual patching / WAF: If you have a web application firewall or reverse proxy, apply vendor- or community-supplied rules that inspect for template injection patterns, while recognizing that such rules are incomplete without the real patch.
• Feature reduction: Disable any non-essential UI or API surfaces that accept free-form input into rendering paths, following vendor guidance on safe configuration.
• Monitoring: Increase logging verbosity for the identity services, alert on process creation and unusual outbound traffic, and forward logs to a SIEM with short retention-to-alert latency. Hunt for the ransomware-related activity patterns your detection stack already knows.

These steps only buy time; schedule the official update as soon as possible.

If your data may have been exposed

Actively exploited vulnerabilities of this class, especially those with known ransomware use, frequently precede broader compromise of identity systems and downstream applications. If you find evidence of exploitation or cannot rule it out, follow your incident response plan: isolate affected hosts, preserve logs and memory where feasible, reset privileged credentials, and assess lateral movement.

You can also run a free exposure scan of your email addresses against known breach data to see whether associated accounts appear in public compilations, then force password resets and enable stronger MFA where needed.