Is CVE-2022-22972 actively exploited?

Yes. CVE-2022-22972 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2022-22972 be exploited remotely?

The attack vector of CVE-2022-22972 has not been classified yet.

What is the CVSS score of CVE-2022-22972?

CVE-2022-22972 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2022-22972

UNKNOWNCISA KEVIN THE WILD

CVE-2022-22972

Published: April 11, 2026

Official Description

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.

NVD Source

Risk Analysis

This vulnerability affects VMware Workspace ONE Access, Identity Manager, and vRealize Automation, allowing an attacker to bypass authentication for local domain users. A malicious actor can gain administrative access to the system without needing to provide credentials. This is a critical vulnerability as it is confirmed to be actively exploited in the wild by CISA.

This vulnerability is actively being exploited in the wild and is included in CISA's Known Exploited Vulnerabilities Catalog. An attacker with network access to the user interface can gain administrative control remotely without authentication.

Recommended Action

It is imperative to apply the available security patches for VMware Workspace ONE Access, Identity Manager, and vRealize Automation. Implement network segmentation and access controls to limit exposure of the UI to untrusted networks.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2022-22972 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2022-22972 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.