CISA issues directive for exploited VMware bug after IR team deployed to ‘large’ org
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-22954 | Server-Side Template Injection RCE in VMware Workspace ONE Access and Identity Manager | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2022-22960 | Local Privilege Escalation in VMware Workspace ONE Access, Identity Manager and vRA | 7.8 | 36% | KEVPoC ×3 | KEV |
CVE-2022-22972+1 related CVE | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users | 9.8 group max | 56% |
From the original article
4 min read at therecord.media
The Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive on Wednesday ordering federal civilian agencies to patch critical vulnerabilities in VMware products. CISA said it released the notice after deploying an incident response team “to a large organization where the threat actors exploited CVE-2022-22954” — the name given to a recently-discovered remote code execution vulnerability.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.