Topics Tools Books & Guides Talk to Securafy

Knowledge Hub / IT Operations

IT Operations

VMWare Products Need Patched Now For Security Risks

VMWare Products Need Patched Now For Security Risks

Randy Hall By Randy Hall Updated Jul 2024 2 min read Share

If you use certain VMWAre products, be aware that the company has recently identified and issued a patch for a total of five critical security vulnerabilities.

These are being tracked as:

  • CVE-2022022954 (This issue is a server-side template injection remote code execution issue)
  • CVE-2022-22955
  • CVE-2022-22956 (This issue, and the one above it are both OAuth2 ACS authentication bypass vulnerabilities)
  • CVE-2022022957
  • And CVE-20220958, with these last two being JDBC injection remote code execution vulnerabilities.

The products impacted by these issues are:

  • vRealize Suite Lifecycle Manager
  • VMware Cloud Foundation
  • VMware vRealize Automation (vRA)
  • VMware Identity Manager (vIDM)
  • And VMware Workspace ONE Access (Access)

The patch the company released to address the issue is VMSA-2021-0011.

The company made a point to stress that different organizations will have varying risk tolerances, security controls, and defenses in place to manage risk. So customers using VMWare equipment should certainly feel free to make their own decisions regarding what priority to place on installing the patch for this issue. They strongly recommended that all their customers take immediate action given the severity of the security vulnerability.

VMware stressed that so far, they have found no evidence of any of these vulnerabilities being exploited in the wild. Of course, it's just a matter of time until that happens and the company recommends applying the patch as soon as possible if you use any of the products mentioned above.

If you are unable to apply the patch immediately, also be aware that the company has a workaround detailed on their website that could be used as a stopgap measure in the short run.  It doesn't remove the risk and it may introduce some added wrinkles and complexities but it's better than doing nothing until the patch can be applied.

Kudos to VMware for their fast action in addressing these issues and in providing a workaround for those who cannot patch immediately.
Tagged Under IT OperationsCybersecurityBusiness Continuity

Join The Conversation

Have a question or perspective on this topic? Add it below.

Randy Hall

About The Author

Randy Hall · CEO & Founder

Randy Hall is the CEO and Founder of Securafy, with decades of experience helping organizations make smarter, safer decisions about technology.

A frequent speaker and instructor at national IT events, Randy has advised thousands of organizations, from startups and SMBs to large enterprises and U.S. government entities, on secure, practical technology adoption. He writes about the decisions business leaders are often expected to make without enough context, including cybersecurity, compliance, AI, cyber insurance, IT strategy, and business resilience.

Outside the office, you’ll often find Randy on Lake Erie enjoying time on his 38-foot Chris-Craft.

Writes about: Cybersecurity strategy, compliance, AI security, business resilience, cyber insurance, SMB risk, IT leadership

More From This Author →

Related Articles

Business Continuity Compliance Risk Assessment: How Downtime Impacts Your Bottom Line

When systems go down, compliance obligations don't pause—and the financial consequences ...

Jul 28, 2026
Compliance HIPAA Security Rule Changes Are Delayed To 2027: Why Healthcare Organizations Should Not Wait

The updated HIPAA Security Rule won't take effect until 2027, but healthcare ...

Jul 23, 2026
Compliance Multi Factor Authentication Best Practices for CJIS Security Policy Compliance

Law enforcement agencies and criminal justice organizations face mounting pressure to ...

Jul 16, 2026
Compliance CMMC Phase II Has Been Suspended: What Defense Contractors Still Need To Do

The Department of Defense suspended CMMC Phase II enforcement, but that doesn't mean ...

Jul 15, 2026
IT Operations Cybersecurity For Veterinary Clinics: Protecting Client Data, Payment Systems, And Practice Operations

Veterinary clinics handle sensitive client data, payment information, and critical ...

Jul 9, 2026
IT Operations AT&T Cybersecurity, AlienVault USM, And Managed Security: What SMBs Still Need To Own

Managed security platforms like AT&T Cybersecurity and AlienVault USM provide ...

Jul 8, 2026

Get Practical Cybersecurity Field Notes

Monthly cybersecurity, compliance, and IT strategy updates from Securafy, written for business owners who need clear next steps.

  • Practical security tips from our Cyber Security Drip series
  • The Securafy Times, our monthly roundup on compliance and IT strategy
  • Occasional updates on new tools, guides, and research
  • No spam — unsubscribe anytime