hekate

🗓️ 01 Oct 2026 16:17:21Reported by KitPloitType

kitploit🔗 kitploit.com👁 12 Views

Unauthenticated RCE as root in VMware Workspace ONE Access 21.08.0.1 via JDBC driver exploitation.

Reporter	Title	Published	Views	Family All 98
zdt	VMware Workspace ONE Remote Code Execution Exploit	18 Apr 202300:00	–	zdt
ICS	Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure	1 Mar 202212:00	–	ics
attackerkb	CVE-2022-22955	13 Apr 202218:15	–	attackerkb
attackerkb	CVE-2022-22961	13 Apr 202218:15	–	attackerkb
attackerkb	CVE-2022-22959	13 Apr 202218:15	–	attackerkb
attackerkb	CVE-2020-4006	23 Nov 202000:00	–	attackerkb
BDU FSTEC	The vulnerability of the vRealize Suite Lifecycle Manager software, a virtualization platform from VMware Cloud Foundation, and administration consoles like VMware Identity Manager and VMware Workspace One Access, arises due to insufficient validation of arguments passed to commands. This allows attackers to execute arbitrary commands.	26 Nov 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the VMware Workspace ONE Access application management platform, the VMware Cloud Foundation virtualization platform, the VMware vRealize Automation virtual infrastructure management tool, the vRealize Suite Lifecycle Manager application lifecycle management software, and the VMware Identity Manager (vIDM) administration console lies in insufficient checks on the HTTP request source. This allows attackers to carry out CSRF attacks.	8 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the OAuth2 ACS access control service of the VMware Workspace One Access application management platform allows a perpetrator to bypass the authentication process and gain unauthorized access to the application.	8 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the VMware Workspace ONE Access application management platform, the VMware Identity Manager administration console, the VMware Cloud Foundation virtualization platform, and the vRealize Suite Lifecycle Manager software for managing application lifecycles is related to a flaw that allows attackers to disclose protected information.	13 Apr 202200:00	–	bdu_fstec

Source	Link
github	www.github.com/sourceincite/hekate/blob/main/postgres/exploit/libs/licensecheck-1.1.5.jar
github	www.github.com/sourceincite/hekate/blob/main/postgres/exploit

01 Oct 2026 16:17Current

7.5High risk

Vulners AI Score7.5

CVSS 29

CVSS 3.19.1 - 9.8

EPSS0.49533

SSVC

Workspace ONE Access remote code execution JDBC driver exploitation unauthenticated VMware vIDM default configuration