CVE coverage
View on NVD →
CVE-2022-22954
CVSS 9.8
Actively exploited (KEV)
4 detections found
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Windows Potential Web Shell Creation For VMware Workspace ONE | production | 2026-05-13 |
| splunk | VMware Server Side Template Injection Hunt | production | 2026-05-13 |
| splunk | VMware Workspace ONE Freemarker Server-side Template Injection | production | 2026-05-13 |
| sigma | Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution | test | 2022-04-25 |