CVE-2022-22954 is a server-side template injection vulnerability in VMware Workspace ONE Access and Identity Manager. CISA added it to the Known Exploited Vulnerabilities catalogue on 14 April 2022, which means attackers have used it in real attacks. VMware Workspace ONE Access and Identity Manager allow for remote code execution due to server-side template injection.
What the vulnerability means in this product
Server-side template injection in VMware Workspace ONE Access and Identity Manager means attacker-supplied template syntax can be evaluated on the server, not just rendered as inert text. That is dangerous because template engines often sit close to application logic, environment variables, configuration, and privileged runtime context.
In practice, SSTI is an application-layer code injection issue rather than a simple display bug. When it succeeds, the attacker may move from input control to server-side expression evaluation, and from there to broader compromise of the host or application process. For a product that brokers access and identity-related workflows, that makes the flaw especially sensitive.
Why server-side template injection is dangerous here
Workspace ONE Access and Identity Manager are high-value targets because they sit on the access path for users, apps, and administrative workflows. A flaw that can reach server-side execution can undermine trust in the access platform itself, which is why CISA inclusion in the KEV catalogue is a strong signal that this is an exploitation-priority issue.
The most important security consequence is that the attacker is no longer limited to manipulating a single request. If template evaluation can be influenced, the application may expose secrets, call privileged functions, or enable remote code execution. Even when the initial payload looks small, the blast radius can be large because the vulnerable component is central to authentication and access orchestration.
For background on the class of attacks, see Web Application Attacks Guide, which includes server-side template injection alongside other injection patterns.
How organisations check exposure and scope
Exposure checking starts with a complete inventory of where VMware Workspace ONE Access and Identity Manager are deployed, including internet-facing instances, reverse-proxy paths, clustered nodes, and any test or disaster-recovery environments that may still be reachable. Public exposure matters because exploited vulnerabilities in externally reachable identity infrastructure tend to be discovered and weaponised quickly.
Organisations should then compare their deployed product builds against the vendor advisory for this exact CVE, and confirm whether any instance is reachable from untrusted networks or used in critical authentication flows. If the platform fronts SSO, federation, or privileged administrative access, any compromise can become a control-plane event rather than a single-server incident.
For authoritative version and exposure detail, use the CVE Program record together with the NIST National Vulnerability Database. The Vulnerability Management Guide is useful for prioritising KEV-listed issues, validating asset scope, and tracking remediation.
Remediation, detection, and compromise review
The preferred response is to apply the vendor fix as soon as operationally possible, because KEV-listed flaws should be treated as active exploitation risks rather than theoretical weaknesses. If patching must wait, isolate the system, reduce exposure, and remove any direct internet reachability that is not strictly necessary for business operation.
Detection should focus on signs that the vulnerable component was already abused before or after remediation. That includes unusual application errors, suspicious template input, unexpected process execution, abnormal child processes, new files or web shells, and changes to configuration or authentication behaviour. After patching, review logs and host telemetry for evidence of post-exploitation activity, because fixing the bug does not remove attacker footholds already established.
Because this product can mediate identity and access, a compromise review should also consider whether administrative sessions, service credentials, signing material, or directory connections could have been exposed. If exploitation is confirmed or strongly suspected, rotate the relevant secrets and validate every connected trust path before returning the system to service.
For a broader treatment of the attack mechanics behind this class, the OWASP Top 10 provides useful context on injection-driven compromise, and Ultimate Guide to NHIs, What are Non-Human Identities helps frame the secret and service-account implications when a platform compromise reaches identity material.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V1 — Encoding and Sanitization | SSTI exploitation depends on unsafe handling of untrusted input in server-rendered templates. |
| V15 — Secure Coding and Architecture | The flaw is an application design and implementation failure that enables code execution. | |
| Recommendation — Harden template input handling and prevent server-side evaluation of untrusted content. Review template rendering paths and eliminate unsafe dynamic evaluation. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Template injection is enabled when untrusted input is accepted into a server-side interpretation path. |
| SI-2 — Flaw Remediation | A KEV-listed exploit requires timely correction and verification of affected systems. | |
| Recommendation — Validate and constrain all user-supplied data before it reaches template processing. Prioritise patching, verify remediation, and track residual exposure until closure. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV-listed exploitation maps directly to prioritised vulnerability management and remediation. |
| Recommendation — Identify the affected instances, prioritise the fix, and confirm remediation completion. | ||
Related resources from NHI Mgmt Group
- CVE-2021-22054 (Omnissa Workspace ONE Server-Side Request Forgery)
- Why do server-side template injection bugs create broader risk than XSS?
- Why do client-side injection bugs matter for identity and access systems?
- How should security teams prevent server-side template injection in CI/CD-driven applications?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org