Actively exploited in the wild
Multiple VMware Products Command Injection Vulnerability
VMware - Multiple Products · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-4006
CriticalCVSS 9.1KEVSummary
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.
Risk Assessment
An attacker can execute arbitrary commands in the context of the service, potentially leading to system compromise.
Recommendation
Apply the patches provided by VMware for the listed products.
Other vulnerabilities in VMware Workspace One Access
Original NVD description (English source)
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS