CVE-2020-4006: Multiple VMware Products Command Injection Vulnerability

Critical severity, CVSS 9.1. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 17.3% chance of exploitation in the next 30 days.

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

Affected products

• VMware Cloud Foundation: version 4.0 only; version 4.0.1 only
• VMware Identity Manager: version 3.3.1 only; version 3.3.2 only; version 3.3.3 only
• VMware Identity Manager Connector: version 3.3.1 only; version 3.3.2 only; version 3.3.3 only
• VMware One Access: version 20.01 only; version 20.10 only
• VMware vRealize Suite Lifecycle Manager: from 8.0, up to and including 8.2

Published 2020-11-23. Last modified 2026-06-17.