Is CVE-2022-22954 (VMware Workspace ONE Access and Identity Manager Server-Side Template Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2022-22954 to its Known Exploited Vulnerabilities catalogue on 14 April 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection. Any organisation running the affected product should treat remediation as urgent.

Why this counts as active exploitation, not just a published CVE

CISA’s KEV listing is the practical line that matters here. Once a vulnerability appears in that catalogue, defenders should assume reliable exploitation evidence exists and treat exposure as real, current, and operationally urgent rather than theoretical. For this class of issue, the decision point is not whether exploitation is possible, but whether the affected system can still be found, contained, and remediated fast enough.

Any environment running VMware Workspace ONE Access or Identity Manager should be handled as potentially exposed until inventory confirms otherwise. An internet-facing instance, a system with delayed patching, or a product that remains in a known vulnerable state after disclosure has a materially higher likelihood of being targeted because exploitation can turn a single application flaw into remote code execution.

When a template injection flaw is already being exploited, the security question becomes whether the attacker can use that execution path to reach credentials, sessions, configuration, or adjacent systems. That is why organisations should view the issue as more than a software defect: it is an access-path problem with possible downstream identity and lateral-movement consequences.

What remediation should happen first

The first priority is confirming exposure, then applying the vendor’s fix or the CISA-directed mitigation without delay. If the environment includes multiple instances, the safest approach is to identify every deployment, verify whether it is internet reachable, and treat each one as independently actionable rather than assuming a single fix covers the whole estate. The Zero-Day and Exploited Vulnerabilities Guide is a useful model for that triage pattern because it focuses on KEV-driven prioritisation, emergency mitigation, and post-patch hunting.

Patch timing should be driven by exploitation reality, not by normal maintenance windows. If remediation must wait, the interim objective is to reduce exposure by shrinking reachability, limiting administrative access, and watching for abnormal process creation, web-shell behaviour, or unexpected changes to the product host. For a remote code execution issue, compensating controls should be treated as temporary risk reduction, not as a substitute for fix deployment.

After remediation, the environment should be checked for signs that exploitation occurred before the fix landed. That means reviewing authentication logs, product logs, host telemetry, and any privileged account activity that could indicate attacker follow-on actions. The Vulnerability Management Guide is useful here because it frames exposure as a lifecycle issue, including verification, exception handling, and evidence of closure rather than patching alone.

What to verify after patching or mitigation

Post-fix validation should answer three questions: was the vulnerable surface removed, was there pre-existing compromise, and did the response actually reduce the blast radius? In practice that means checking for persistence mechanisms, unexpected local accounts, altered startup items, suspicious scheduled tasks, and any outbound activity that would suggest the server was used as an execution foothold.

This is also the point to review credentials and sessions associated with the affected appliance or its integrations if there is any sign of compromise. If the product handled tokens, admin sessions, or connected service credentials, assume those may need rotation or revocation. The Web Application Attacks Guide helps anchor that investigation because server-side template injection is part of the broader set of input-driven application flaws that often lead directly to execution and follow-on abuse.

For teams that want a clean post-incident discipline, the key is to distinguish between “patched” and “verified safe.” A patched host with unexplained process creation, unknown files, or a history of exposure should still be treated as suspect until the investigation closes those gaps.

Risk and Threat Considerations

This kind of flaw is attractive because it can give an attacker direct code execution in a high-value identity product, which can then be used to pivot into adjacent systems or to harvest access material. In an environment that trusts the appliance for authentication or identity workflows, compromise can have a much wider impact than a single server breach.

Failure mechanism: Server-side template injection lets attacker-controlled input influence server-side rendering logic, which can be turned into code execution when input handling and templating boundaries are weak.

Impact: Once execution is achieved, the attacker may be able to steal data, alter configuration, establish persistence, or use the server as a launch point for broader compromise, including credential or session abuse.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	Supports identifying exposed systems before exploitation becomes an incident.
Recommendation — Identify every affected instance and verify exposure before declaring the vulnerability contained.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	Directly supports finding and tracking exploitable flaws across the environment.
Recommendation — Scan and track the vulnerable product until remediation and validation are complete.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Fits KEV-driven prioritisation and rapid remediation of actively exploited flaws.
Recommendation — Prioritise and remediate KEV-listed exposures ahead of routine vulnerability queues.
OWASP ASVS	V15 — Secure Coding and Architecture	Server-side template injection is an application-architecture weakness that breaks trust boundaries.
Recommendation — Review server-side rendering paths to prevent attacker-controlled template execution.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	Captures public-facing application exploitation used to gain initial access via the vulnerable product.
Recommendation — Map detections and hunting to public-facing application exploitation paths.

Practitioner Guidance

What to prioritise: Start with inventory and exposure confirmation, then move immediately to patching or vendor-directed mitigation for every reachable instance. If you cannot answer where the product is deployed, you do not yet have a defensible risk position.

What to verify: Confirm whether the host shows any signs of pre-fix activity, especially unexpected processes, new files, modified configuration, or abnormal administrative logins. If any of those are present, treat the event as a compromise assessment, not a routine patch ticket.

Practitioner takeaway: For a KEV-listed RCE flaw, the operational question is not whether it is dangerous, but whether you have already proven the affected system was not used before you fixed it.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org