CVE-2021-22002: VMware Cloud Foundation

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in addition a malicious actor could access /cfg diagnostic endpoints without authentication.

Affected products

• VMware Cloud Foundation: version 4.0 only; version 4.0.1 only; version 4.1 only; version 4.1.0.1 only; version 4.2.1 only
• VMware Identity Manager: version 3.3.2 only; version 3.3.3 only; version 3.3.4 only; version 3.3.5 only
• VMware vRealize Suite Lifecycle Manager: version 8.0 only; version 8.0.1 only; version 8.1 only; version 8.2 only
• VMware Workspace One Access: version 20.01 only; version 20.10 only; version 20.10.01 only

Published 2021-08-31. Last modified 2026-06-17.