Is CVE-2022-22960 (VMware Multiple Products Privilege Escalation) being exploited in the wild?

Yes. CISA added CVE-2022-22960 to its Known Exploited Vulnerabilities catalogue on 15 April 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.

What CISA’s KEV Listing Means for CVE-2022-22960

CISA’s KEV catalogue is the practical signal that turns a vulnerability from “theoretical risk” into “confirmed active exploitation.” For CVE-2022-22960, that means defenders should treat exposure in VMware Workspace ONE Access, Identity Manager, and vRealize Automation as an urgent matter, not a routine patch item. The key question is whether any internet-facing or reachable instance is still vulnerable, not whether exploitation has already been observed inside your own environment.

For vulnerability triage and response workflow, use the Zero-Day and Exploited Vulnerabilities Guide to align KEV status, emergency mitigation, and post-patch verification with the decision speed this class of issue requires. The same approach is reinforced by the CISA Known Exploited Vulnerabilities Catalog, which is the authoritative source for active-exploitation prioritisation.

Because the flaw is a privilege escalation issue, the operational concern is not only initial access but what an attacker can do after reaching the affected component. That makes exposure assessment, blast-radius review, and any evidence of unusual administrative activity part of the response, alongside patching.

How to Confirm Exposure and Reduce Immediate Risk

Start by inventorying every instance of the affected VMware products, then confirm whether any of them are externally reachable, poorly segmented, or managed outside the normal patch cadence. If you do not know where the products are deployed, you do not yet know your exposure level. That is especially important for platforms that support access, identity, and automation workflows, because compromise can cascade into other systems.

Where exposure exists, the first objective is to remove the exploit path or reduce reachability while you apply the vendor fix or approved mitigation. If patching must wait, restrict network access to the management plane, tighten administrative access, and monitor for privilege escalation attempts or unusual script execution around the affected services.

Use the Vulnerability Management Guide for prioritisation discipline, exception handling, and verification after remediation. If privileged access is involved in the affected deployment, the Privileged Access Management Guide is a useful reference for constraining who can reach the control plane and how those sessions are governed.

One common mistake is to treat the vulnerable product as if it were just another application server. In practice, these platforms often sit close to authentication, device management, administrative access, or automation paths, so compromise can be disproportionately valuable to an attacker.

What to Check for Evidence of Prior Compromise

After a KEV-listed issue has been publicly known for some time, the question is not only whether you can patch now, but whether exploitation may already have occurred. Review authentication events, admin activity, recent configuration changes, and any unexpected privilege changes tied to the VMware environment. Look for accounts, tokens, or sessions that gained privileges they should not have had.

If the affected system was used to administer other infrastructure, validate downstream trust paths as well. When a privileged management platform is involved, compromise may leave behind more than a single altered host: it can expose credentials, sessions, API access, or automation pathways that should be rotated or reissued after remediation.

For broader attack-path context, the MITRE ATT&CK Enterprise Matrix helps map privilege escalation to follow-on activity such as lateral movement and credential access. If the environment depends heavily on privileged administration, the Cloud PAM and CIEM Guide adds useful reader navigation for evaluating effective privileges and escalation paths.

Risk and Threat Considerations

Privilege-escalation flaws in identity-adjacent or management-plane software are attractive because they can turn limited footholds into high-value administrative control. When the vulnerable product also manages access, automation, or infrastructure, the exploit can become a shortcut to broader environment control rather than a single-host event.

Failure mechanism: Improper permissions in support scripts allow a lower-privileged context to perform actions that should have remained restricted, enabling privilege escalation after initial access.

Impact: An attacker who reaches the vulnerable component may be able to increase privileges, modify configuration, access sensitive administrative functions, or pivot toward broader compromise of connected systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	CVE-2022-22960 needs exposure discovery and remediation prioritization.
	AC-6 — Least Privilege	The issue is a privilege escalation flaw tied to improper permissions.
	SI-2 — Flaw Remediation	Active exploitation makes timely patching and mitigation essential.
Recommendation — Scan for affected VMware instances and prioritize remediation of exposed deployments. Reduce administrative reach and remove unnecessary privileges from management paths. Apply vendor fixes or mitigations quickly and verify remediation completed.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation requires continuous identification and prioritization.
	CIS-6 — Access Control Management	Privilege escalation risk depends on controlling administrative access paths.
Recommendation — Prioritize KEV-listed VMware flaws for rapid remediation and validation. Restrict management access and review privileged accounts for excess access.

Practitioner Guidance

What to prioritise: Confirm whether any deployed instance is still exposed, then validate whether it can be reached by untrusted networks or excessive admin pathways. If the answer is yes, treat the instance as a priority remediation target even before you have perfect certainty about exploitation.

What to verify: After patching or mitigation, confirm that administrative access, service accounts, and management workflows still behave as intended and that no unusual privilege changes remain. If the platform was used to broker access or automation, rotate the secrets or sessions that could have been exposed during the vulnerable period.

Practitioner takeaway: For KEV-listed privilege escalation issues, the real decision point is not whether the flaw is interesting, but whether it gave an attacker a path from routine access to administrative reach; if so, patching and compromise assessment should move together.