CVE-2022-22960
VMware Multiple Products — VMware Multiple Products Privilege Escalation Vulnerability
Description
Response & Mitigation
Why act now?
Prioritisation rationale
CVE-2022-22960 is a local privilege escalation with CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) and an EPSS score in the 98.4th percentile, indicating that exploit code is widely available and actively used. The vulnerability is especially critical in environments where Workspace ONE Access or Identity Manager serves as the central identity provider for hybrid cloud infrastructure: an attacker who has already obtained low-privileged access — for example via CVE-2022-22954, an RCE flaw addressed in the same advisory — can chain CVE-2022-22960 to gain immediate root access and fully compromise the IAM trust anchor. NIS2-scoped organisations running VMware-based identity infrastructure should treat this as P1 regardless of the absence of a confirmed ransomware campaign flag: the combination of near-top-percentile EPSS and the central role these systems play in authentication chains makes immediate remediation non-negotiable.
Runbook · Step 1
Immediate response (0-24 h)
- Apply VMware security patch immediately: VMSA-2022-0011 addresses CVE-2022-22960 across Workspace ONE Access, Identity Manager, and vRealize Automation — verify exact build numbers in the vendor advisory VMSA-2022-0011 against your installed versions before deploying.
- Patch Cloud Foundation (versions 3.x–5.x) and vRealize Suite Lifecycle Manager (8.x–9.x) as well — both product lines are in scope; VMware provides separate patch bundles via SDDC Manager.
- Immediately audit local accounts on affected appliances: check whether non-privileged service accounts (e.g.
horizon,hzncloud,wsntp) have been escalated torootsince the patch became available. - Restrict SSH access to affected appliances to dedicated jump hosts and disable interactive logins for all non-administrative accounts until the patch is applied.
- Rotate passwords for all local accounts on affected appliances — especially
admin,root, and any service accounts with access to support scripts.
Runbook · Step 2
Mitigation layers
- Network segmentation: Limit access to management interfaces (typically TCP 443, 8443, 22) of affected appliances to a dedicated management VLAN; block outbound connections from appliances to the internet.
- Least-privilege / IAM: Review and tighten sudo rules on appliances — specifically
/etc/sudoers.d/entries granting unrestricted rights to service accounts; remove or minimiseNOPASSWDentries. - Filesystem hardening: Manually set permissions on support scripts under
/opt/vmware/and/usr/local/horizon/toroot:root 0750or more restrictive if the patch cannot be applied immediately — document changes, as updates may overwrite them. - IDS/IPS rule: Monitor for anomalous SSH sessions originating from appliance IPs to internal systems at the network layer — a strong lateral-movement indicator following a successful escalation.
- Privileged Access Workstation (PAW): Enforce administrative access to affected systems exclusively via hardened PAW hosts with MFA.
Runbook · Step 3
Detection rules
- Linux auditd: Set a rule on
execvesyscalls whereuid!=0andeuid=0on affected appliances — escalation to root without a legitimate sudo call is a strong indicator:auditctl -a always,exit -F arch=b64 -S execve -F uid!=0 -F euid=0 -k priv_esc_cve22960 - Syslog / auth.log: Monitor for patterns
sudo:.*COMMAND=.*support.*orsu.*rootin/var/log/auth.logon appliances for unexpected service accounts; SPL snippet:source="/var/log/auth.log" ("sudo" OR "su") "root" NOT user IN ("admin","root") - File Integrity Monitoring (FIM): Alert on writes to scripts under
/opt/vmware/scripts/,/usr/local/horizon/scripts/, and/etc/sudoers.d/; SIEM rule shape:file_path MATCHES "/opt/vmware/scripts/*" AND event_type="WRITE" AND actor_uid!="0" - EDR / process ancestry: Flag process chains
support_script.sh → bash → id/whoami/passwdor similar reconnaissance commands running witheuid=0on appliance hosts as high-severity alerts. - Sigma rule shape:
title: VMware Support Script Privilege Escalation | logsource: product: linux | detection: selection: exe|contains: ['/opt/vmware', '/usr/local/horizon'] AND euid: 0 AND uid|not: 0 | condition: selection
Metrics
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
vmware
cloud_foundation3.0 – 5.0
vmware
identity_manager
vmware
vrealize_automation
vmware
vrealize_suite_lifecycle_manager8.0 – 9.0
vmware
workspace_one_access
Public exploit references
Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.
References & sources
- https://www.vmware.com/security/advisories/VMSA-2022-0011.html
- http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/171918/VMware-Workspace-ONE-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/171935/VMware-Workspace-ONE-Access-Privilege-Escalation.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22960government-resource