CVE-2022-22956

What it actually does

CVE-2022-22956 is an authentication bypass in the OAuth2 ACS framework used by VMware Workspace ONE Access and related identity products. Exposed authentication-framework endpoints can be reached remotely without credentials, allowing an attacker to bypass normal access controls and invoke privileged application operations. Because the vulnerable component sits in an identity and access management stack, successful exploitation can compromise confidentiality, integrity, and availability by enabling unauthorized administrative actions, identity manipulation, configuration changes, or follow-on access to integrated services.

Why it matters to the business

A vulnerable deployment can allow an unauthenticated internet- or network-accessible attacker to take over key identity-management functions. In business terms, this can lead to unauthorized access to enterprise applications, disruption of single sign-on, manipulation of users or authentication settings, data exposure, and a broad compromise path into dependent systems. The CVSS 9.8 severity, network exploitability, no-credential requirement, and weaponized exploit maturity make this a high-priority issue even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an exposed VMware Workspace ONE Access, VMware Identity Manager, or related appliance hosting the vulnerable OAuth2 ACS functionality. They then send crafted unauthenticated requests directly to exposed ACS/OAuth2 framework endpoints that should normally be protected by the authentication mechanism. Because the vulnerable framework fails to enforce authentication correctly, the attacker can bypass access checks and perform operations as if authenticated. Depending on configuration and exposed functionality, this may allow administrative or identity-related changes, creation or modification of authentication artifacts, access to protected resources, or staging for broader compromise of applications relying on the identity provider.

How to fix it

Upgrade affected VMware Workspace ONE Access, VMware Identity Manager, and related VMware products to vendor-supported versions that contain the fixes for CVE-2022-22955 and CVE-2022-22956. Because no exact fixed versions were provided in the input, consult the applicable VMware advisory for the specific product branch and deploy the recommended patched appliance or hotfix. If immediate patching is not possible, restrict network access to identity-management administrative and authentication endpoints, place the appliance behind trusted access controls, block direct internet exposure, enforce least-privilege administrative access, and monitor for suspicious unauthenticated requests to OAuth2/ACS endpoints. Treat mitigation as temporary; the durable fix is applying the vendor patch or upgrading to a non-vulnerable release.

How to confirm the fix worked

Confirm the installed product and build match a VMware advisory version that is not affected by CVE-2022-22956. Validate that exposed Workspace ONE Access or VMware Identity Manager endpoints are not directly reachable from untrusted networks except where explicitly required. Perform an authenticated and unauthenticated configuration review to ensure OAuth2 ACS endpoints require proper authentication and do not allow privileged operations anonymously. Use vulnerability scanners or vendor-provided checks where available, and verify appliance update history, package versions, and service restarts after patching. Re-test with safe, non-destructive probes only; do not attempt unauthorized state-changing operations in production.

Typical attack path

1. Scan for externally reachable VMware Workspace ONE Access, VMware Identity Manager, or related VMware identity appliances.
2. Fingerprint the product and version through HTTP headers, login pages, static assets, or known endpoint behavior.
3. Probe OAuth2 ACS framework endpoints for unauthenticated access and vulnerable response patterns.
4. Send crafted requests to bypass authentication on exposed framework endpoints.
5. Execute unauthorized operations within the identity-management application.
6. Establish persistence or expand access by modifying users, tokens, federation settings, connectors, or authentication configuration where possible.
7. Use compromised identity functions to access downstream enterprise applications or disrupt authentication services.

How to detect it

Review Workspace ONE Access, VMware Identity Manager, reverse proxy, load balancer, and web application firewall logs for suspicious unauthenticated access to OAuth2 ACS-related endpoints, especially requests returning successful status codes without a prior login session. Correlate anomalous endpoint access with administrative events, user or group changes, OAuth client changes, connector changes, federation or SAML configuration updates, token issuance spikes, and unexpected authentication-policy modifications. Examine application audit logs for operations performed by unknown, anonymous, system, or unexpected principals. Check for unusual source IPs, repeated probing of authentication endpoints, abnormal HTTP methods, malformed parameters, and sequences where unauthenticated requests are followed by privileged actions. If compromise is suspected, collect appliance logs, access logs, audit logs, configuration snapshots, and identity-provider metadata for forensic review; also inspect downstream applications for unusual SSO-based access that occurred after suspicious ACS/OAuth2 activity.

• /SAAS/
• /SAAS/API/
• /SAAS/auth/
• /SAAS/jersey/
• /SAAS/t/
• /acs
• /ACS
• /oauth2
• /OAuth2
• /oauth
• /authorize
• /token
• /login
• anonymous
• Authentication bypass
• No authentication
• Unauthenticated request

What your security team should do

• Prioritize patching or upgrading any internet-facing VMware Workspace ONE Access, VMware Identity Manager, or related VMware identity appliances immediately due to critical severity and weaponized exploit availability.
• Inventory all VMware identity appliances, including those embedded in or supporting vRealize Automation and other dependent services.
• Restrict access to administrative, OAuth2, ACS, and identity-management endpoints to trusted networks and management paths only.
• Review identity-provider configuration for unexpected users, clients, OAuth applications, federation changes, authentication rule changes, and connector modifications.
• Hunt historical web access logs for unauthenticated requests to OAuth2 or ACS endpoints followed by administrative or configuration activity.
• Rotate credentials, tokens, client secrets, and federation trust material if exploitation is suspected.
• Increase monitoring around single sign-on failures, anomalous token issuance, new administrative users, and unusual downstream application access.
• Document compensating controls and remediation status because weaponized public exploitation substantially raises operational risk.