Security News > 2022 > May > VMware Releases Patches for New Vulnerabilities Affecting Multiple Products

VMware has issued patches to contain two security flaws impacting Workspace ONE Access, Identity Manager, and vRealize Automation that could be exploited to backdoor enterprise networks.

The first of the two flaws, tracked as CVE-2022-22972, concerns an authentication bypass that could enable an actor with network access to the UI to gain administrative access without prior authentication.

The disclosure follows a warning from the U.S. Cybersecurity and Infrastructure Agency that advanced persistent threat groups are exploiting CVE-2022-22954 and CVE-2022-22960 - two other VMware flaws that were fixed early last month - separately and in combination.

"An unauthenticated actor with network access to the web interface leveraged CVE-2022-22954 to execute an arbitrary shell command as a VMware user," it said.

"CISA expects threat actors to quickly develop a capability to exploit these newly released vulnerabilities in the same impacted VMware products," the agency said.

The agency has also released a follow-up advisory with regards to the active exploitation of CVE-2022-1388, a recently disclosed remote code execution flaw affecting BIG-IP devices.

News URL

https://thehackernews.com/2022/05/vmware-releases-patches-for-new.html