CVE-2022-22960: VMware Multiple Products Privilege Escalation Vulnerability

CVE-2022-22960 is a privilege escalation vulnerability affecting multiple VMware products, specifically Workspace ONE Access, Identity Manager, and vRealize Automation. It stems from improper permissions in support scripts, which can allow an attacker who already has some level of access to gain higher privileges on the system. For IT and security teams, this matters because these products often sit in identity and automation paths; successful escalation can expand an attacker’s control over authentication, orchestration, or adjacent infrastructure.

CISA lists the required action as applying updates per vendor instructions. Known ransomware use is not documented for this CVE. Confirm all product names, fixed builds, and deployment-specific guidance against the official VMware advisory before acting.

How it works

The weakness is classified as CWE-250 (Execution with Unnecessary Privileges). In plain terms, support scripts shipped with the affected products run or are reachable under permissions that are broader than required. An attacker who can already interact with the host or application—through a lower-privileged account, a compromised service identity, or another foothold—can abuse those overly permissive scripts to perform actions or obtain rights they should not have.

Exact exploit mechanics, preconditions, and attack chains are not detailed in the provided facts. Treat this as a local or authenticated privilege-escalation issue typical of mis-permissioned administrative or support tooling. Do not assume remote unauthenticated exploitation unless the vendor advisory explicitly states it. Always validate the attack surface and required access level against VMware’s advisory for your exact product and version.

Am I affected? How to find it in your systems

These components commonly appear in enterprise identity, workspace, and cloud-automation environments. Workspace ONE Access and Identity Manager often front single sign-on and directory integration; vRealize Automation is used for infrastructure and application provisioning. They may run as appliances, virtual machines, or integrated services in data centers or private clouds.

• Inventory: Query CMDB, hypervisor inventories, configuration-management databases, and software asset tools for installations of VMware Workspace ONE Access, Identity Manager, and vRealize Automation. Include lab, DR, and secondary sites.
• Version and configuration check: Compare installed builds and patch levels to the fixed versions listed in the vendor advisory. Pay attention to whether support or diagnostic scripts are present and what file-system or execution permissions they hold.
• Access review: Identify accounts and service principals that can reach the management interfaces or the host OS where these products run.
• Telemetry signs: Look for unexpected execution of support or diagnostic scripts, sudden privilege changes, new local administrative accounts, or anomalous process trees originating from the product’s install paths. Correlate with authentication logs and host-based detection alerts. Specific indicators of compromise are not supplied in the facts; rely on vendor and internal baselines.

If public detail on exact vulnerable builds is limited in your environment’s records, treat any unpatched instance of the named products as in-scope until confirmed otherwise against the advisory.

How to remediate

Patch first. Apply the updates VMware released for the affected products exactly as described in the vendor advisory and follow CISA’s direction to apply updates per vendor instructions. Schedule maintenance windows that cover all instances, including non-production systems that share credentials or network trust with production.

• After patching, verify the new build numbers and confirm that the improper permissions on support scripts have been corrected.
• Harden residual risk for this class of issue: remove or restrict execute permissions on any remaining support or diagnostic scripts that are not required for operations; run services under least-privilege accounts; disable unused management interfaces; and enforce strict file-integrity monitoring on the product install directories.
• Re-validate network segmentation so that only authorized administrative jump hosts can reach the management planes of these products.
• Document the change and retain evidence of patch installation for audit and incident-response readiness.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls focused on limiting who can reach the vulnerable components and what those components can do.

• Segmentation: Isolate the affected appliances or hosts on restricted management networks; block unnecessary lateral paths from user subnets and general server VLANs.
• Access control: Tighten authentication to the products (MFA for admins, break-glass procedures, short-lived credentials) and remove standing privileges that are not essential.
• Feature and script restriction: Disable or uninstall non-essential support scripts and diagnostic features if the product allows it without breaking core function; confirm impact with VMware documentation.
• Virtual patching / monitoring: If a WAF or host IPS is in the path, apply any vendor- or community-supplied rules that constrain script execution or privilege-related API calls—test carefully. Increase logging and alerting on process creation, permission changes, and authentication anomalies around these systems.
• Compensating detection: Forward host and application logs to a SIEM; alert on execution of known support-script names or unexpected elevation events.

These measures lower risk but do not replace the patch. Track the exception and remediate as soon as operationally feasible.

If your data may have been exposed

Actively exploited privilege-escalation flaws can lead to broader compromise of identity systems and the environments they control. If you have evidence of exploitation or cannot rule it out, follow your incident-response plan: isolate affected hosts, preserve logs and disk images, rotate credentials and secrets that the products could access, and assess downstream impact on directories and automated workloads. Known ransomware use is not documented for this CVE; still treat any confirmed intrusion seriously. As a routine check, users can run a free exposure scan of their email addresses against known breach data sets to see whether associated credentials have appeared in prior incidents.