CVE-2022-22960: VMware Cloud Foundation Escalation Flaw

CVE-2022-22960 Overview

CVE-2022-22960 is a privilege escalation vulnerability affecting VMware Workspace ONE Access, Identity Manager, and vRealize Automation products. The vulnerability exists due to improper permissions in support scripts, allowing a malicious actor with local access to escalate privileges to root on affected systems. This vulnerability has been added to the CISA Known Exploited Vulnerabilities Catalog, indicating active exploitation in the wild.

Critical Impact
Local attackers can escalate privileges to root, gaining complete control over the affected VMware appliance. This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.

Affected Products

VMware Workspace ONE Access (versions 20.10.0.0, 20.10.0.1, 21.08.0.0, 21.08.0.1)
VMware Identity Manager (versions 3.3.3, 3.3.4, 3.3.5, 3.3.6)
VMware vRealize Automation (version 7.6)
VMware Cloud Foundation
VMware vRealize Suite Lifecycle Manager

Discovery Timeline

April 13, 2022 - CVE-2022-22960 published to NVD
October 30, 2025 - Last updated in NVD database

Technical Details for CVE-2022-22960

Vulnerability Analysis

This vulnerability falls under CWE-732 (Incorrect Permission Assignment for Critical Resource). The affected VMware products contain support scripts that are deployed with improper file permissions. These misconfigured permissions allow a local attacker with initial access to the system—even with limited privileges—to abuse the support scripts to gain root-level access on the underlying Linux operating system.

The flaw is particularly dangerous in enterprise environments where VMware Workspace ONE Access, Identity Manager, and vRealize Automation serve as critical identity and automation infrastructure components. Successful exploitation provides attackers with complete administrative control over the affected appliance, enabling further lateral movement, data exfiltration, or deployment of persistent backdoors.

Root Cause

The root cause of CVE-2022-22960 is improper permission assignment for critical support scripts within the affected VMware products. These scripts, intended for diagnostic and maintenance operations, are configured with overly permissive file permissions that allow low-privileged users to execute or modify them. When combined with the script's ability to perform privileged operations, this creates a direct path to privilege escalation.

Attack Vector

The attack requires local access to the vulnerable system. An attacker who has gained initial access—potentially through another vulnerability, compromised credentials, or legitimate low-privileged access—can identify and exploit the misconfigured support scripts. By executing or manipulating these scripts, the attacker can perform operations that result in elevated privileges, ultimately achieving root access on the system.

The exploitation chain typically involves:

Initial access to the system with low-privilege credentials
Identification of vulnerable support scripts with improper permissions
Execution or modification of these scripts to escalate privileges
Achievement of root access on the underlying Linux system

This vulnerability is often chained with other VMware vulnerabilities (such as CVE-2022-22954) to achieve remote code execution followed by privilege escalation. For detailed technical information, see the Packet Storm Privilege Escalation advisory.

Detection Methods for CVE-2022-22960

Indicators of Compromise

Unexpected changes to file permissions on VMware support scripts
Evidence of unauthorized privilege escalation in system logs
Suspicious root-level process spawning from support script directories
Anomalous authentication events or new privileged accounts on VMware appliances

Detection Strategies

Monitor for unexpected changes to file permissions on VMware support scripts using file integrity monitoring (FIM) solutions
Audit system logs for privilege escalation attempts or successful root access from non-standard paths
Implement behavioral analysis to detect unusual command execution patterns on VMware appliances
Review authentication logs for lateral movement from compromised VMware identity management systems

Monitoring Recommendations

Enable verbose logging on VMware Workspace ONE Access, Identity Manager, and vRealize Automation appliances
Implement centralized log collection and SIEM integration for real-time alerting
Monitor for indicators associated with known exploit chains combining CVE-2022-22960 with CVE-2022-22954
Conduct regular security assessments to verify proper permission configuration on support scripts

How to Mitigate CVE-2022-22960

Immediate Actions Required

Apply VMware security patches immediately as detailed in VMSA-2022-0011
Review and harden file permissions on support scripts within affected VMware products
Implement network segmentation to limit access to VMware management interfaces
Conduct forensic analysis on affected systems to determine if exploitation has occurred
Reset credentials and review privileged accounts on affected VMware appliances

Patch Information

VMware has released security patches addressing this vulnerability in VMSA-2022-0011. Organizations should apply the patches immediately, given the active exploitation of this vulnerability. The security advisory provides detailed patching instructions for each affected product version. Refer to the VMware Security Advisory VMSA-2022-0011 for complete patch information and download links.

Workarounds

Restrict local access to VMware appliances to only essential personnel
Implement strict network access controls to limit who can reach VMware management interfaces
Manually audit and correct file permissions on support scripts until patches can be applied
Enable enhanced monitoring and alerting on VMware appliances to detect exploitation attempts

bash

# Verify VMware appliance version and patch status
# Run from appliance console to check current version
vamicli version --appliance

# Review file permissions on support scripts (example)
ls -la /opt/vmware/horizon/workspace/scripts/

# Check for unauthorized modifications to support scripts
find /opt/vmware -type f -perm /o=w -exec ls -la {} \;