Loading story…
Attackers sharply increased exploitation attempts against CVE-2022-22954, a critical remote code execution flaw affecting VMware Workspace ONE Access, VMware Identity Manager, and related products covered by VMware advisory VMSA-2022-0011. The vulnerability, rated CVSS 9.8, was disclosed by VMware as part of updates addressing multiple flaws, and security monitoring showed probing beginning shortly after disclosure before spiking significantly later as attackers intensified scanning and exploitation activity.
Observed payloads attempted to execute shell commands that would fetch and run malicious binaries using tools such as wget and curl, indicating efforts to gain remote control of exposed systems after successful compromise. Monitoring data cited major apparent source locations including Lithuania and the United States, and defenders were urged to apply VMware’s published patches or mitigations immediately to reduce exposure to active internet exploitation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On August 18, 2022, MBSD-SOC observed a sharp increase in exploitation attempts for CVE-2022-22954. Example payloads attempted to download and execute a malicious binary named cutie.x86_64 using wget or curl.
During August 2022, MBSD-SOC observed increased attack activity exploiting CVE-2022-22954 against affected VMware products. The article notes Lithuania and the United States as major observed source countries.
MBSD-SOC reported that it intermittently observed attacks targeting CVE-2022-22954 starting on April 12, 2022. The observed exploit traffic targeted the /catalog-portal/ui/oauth/verify endpoint and attempted remote command execution.
In April 2022, VMware disclosed CVE-2022-22954, a critical remote code execution vulnerability affecting Workspace ONE Access, Identity Manager, and related products, and published security advisory VMSA-2022-0011 with fixes or workarounds.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers actively exploited **VMware Workspace ONE Access**, **Identity Manager**, and **vRealize Automation** flaws in the wild, with **`CVE-2022-22954`** emerging as the primary initial access vector. Palo Alto Networks Unit 42 said exploitation began shortly after VMware disclosed the issue, describing the bug as a trivial server-side template injection that can be triggered with a single HTTP request for remote code execution. The activity prompted a **CISA alert**, and researchers warned that related VMware flaws **`CVE-2022-22972`** and **`CVE-2022-22973`** were also highly likely to be targeted. Observed post-exploitation activity included deployment of **Mirai** and **Gafgyt** variants, **Enemybot**, webshells, Perl-based shellbots, coinminers, and payloads that modified SSH keys for persistence. Unit 42 reported that attackers could chain **`CVE-2022-22960`** after the initial compromise to escalate privileges to root by abusing writable paths and sudo-accessible scripts. The company said its Threat Prevention signature **`92483`** blocks exploitation attempts and noted that **about 800 internet-exposed Workspace ONE Access instances** were visible, underscoring the exposure risk for unpatched organizations.
Jun 29, 2026
A critical **VMware vCenter** directory traversal flaw, tracked as `CVE-2026-59310`, is being actively exploited to achieve unauthenticated remote code execution through the vCenter Syslog Server component. Broadcom disclosed the issue and released emergency patches, warning that any attacker with network access to a vulnerable system could run arbitrary code. No workaround was provided, leaving patching and exposure reduction as the primary defenses for affected vCenter deployments. Incident responders at QUIRSO reported exploitation beginning shortly after disclosure and said attackers are deploying the open-source **`reverse_ssh`** tool to establish outbound command-and-control channels and maintain persistence. The firm counted **361 victim IP addresses across 47 countries** within days, while administrators on r/sysadmin amplified warnings to patch immediately and noted that internet-exposed or poorly isolated vCenter instances remain especially vulnerable. QUIRSO said the activity may be linked to an APT actor, though it has not publicly released supporting evidence and is coordinating indicators with law enforcement.
Aug 17, 2026
Broadcom issued **VMSA-2025-0010** to fix four vulnerabilities across VMware ESXi, vCenter Server, Workstation, Fusion, Cloud Foundation, Telco Cloud Platform, and Telco Cloud Infrastructure, led by **CVE-2025-41225**, an authenticated command-execution flaw in **vCenter Server** with a **CVSS 8.8** score. According to the advisory, an attacker able to create or modify alarms and run script actions could exploit the bug, while additional fixes address **CVE-2025-41226** and **CVE-2025-41227** denial-of-service issues and **CVE-2025-41228**, a reflected **XSS** flaw affecting ESXi and vCenter Server. VMware said patches are available for all affected products and that **no workarounds** exist. The latest advisory follows earlier VMware warnings over serious **vCenter Server** weaknesses, including **VMSA-2024-0012**, which disclosed **CVE-2024-37079**, **CVE-2024-37080**, and **CVE-2024-37081** as memory-management and corruption flaws that could enable **remote code execution** in vCenter services. VMware said at the time it had no evidence of active exploitation, but urged customers to apply the listed patch versions because no official mitigations were provided; public GitHub material later appeared referencing **CVE-2024-37081**, underscoring continued security attention on vCenter exposure.
Jun 29, 2026