Privilege Escalation in VMware Workspace ONE Access, Identity Manager, and vRealize Automation (CVE‑2022‑22960)
What It Is – VMware disclosed a privilege‑escalation flaw (CVE‑2022‑22960) affecting Workspace ONE Access, Identity Manager, and vRealize Automation. Improper permission checks in support scripts allow a low‑privileged user to execute actions as an administrator.
Exploitability – Publicly disclosed; proof‑of‑concept code is available. The CVSS v3.1 base score is 7.8 (High), indicating a realistic path to full system compromise if unpatched.
Affected Products – VMware Workspace ONE Access, VMware Identity Manager, VMware vRealize Automation (multiple versions prior to the vendor‑released patch).
Why It Matters for Trust & Control Assurance
- Access Control – The flaw highlights gaps in least‑privilege enforcement for internal scripts, a core control objective across most governance frameworks.
- Continuous Monitoring – Detecting unauthorized script execution requires robust logging and real‑time alerting, providing defensible evidence for auditors.
- Audit Readiness – Demonstrating that privileged permissions are regularly reviewed and validated is a key trust signal for enterprise buyers.
Recommended Actions
- Deploy VMware’s security patch for CVE‑2022‑22960 without delay.
- Conduct an immediate inventory of all support scripts and verify that they run with the minimum required privileges.
- Harden IAM policies to enforce strict least‑privilege for service accounts and scripts.
- Enable detailed audit logging for privileged actions and integrate with a SIEM for continuous monitoring.
- Document the remediation steps and retain evidence for compliance audits.
Source: CISA KEV – CVE‑2022‑22960