Grey Noise | Vulnerabilities in VMWare Workspace ONE products
Summary: On August 2, 2022, VMware disclosed two vulnerabilities in VMware Workspace ONE products and published patched versions to remediate them. GreyNoise created tags for tracking and blocking exploit activity on the CVEs, and as of its blog's publication date had not observed either CVE being actively exploited in the wild.
What's compelling: The researcher who disclosed the flaws, Petrus Viet, tweeted a screenshot on August 2 showing successful exploitation of the CVE-2022-31656 authentication bypass, and GreyNoise researchers speculate his work was based on the Horizon3 CVE-2022-22972 PoC from May 2022 - meaning a working path to bypass authentication on Workspace ONE was demonstrated publicly before many organizations had patched.
Read the original at GreyNoise Blog ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2022-22972CVE-2022-31656
- Related
- Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022-22954 and Others) Cyber Risks ·New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026