CVE-2022-22956: VMware Identity Manager

Critical severity, CVSS 9.8. EPSS: 49.5% chance of exploitation in the next 30 days.

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.

Affected products

• VMware Identity Manager: version 3.3.3 only; version 3.3.4 only; version 3.3.5 only; version 3.3.6 only
• VMware vRealize Automation: from 8.0, before 9.0 (fixed in 9.0); version 7.6 only
• VMware Workspace One Access: version 20.10.0.0 only; version 20.10.0.1 only; version 21.08.0.0 only; version 21.08.0.1 only

Published 2022-04-13. Last modified 2026-06-17.