Vigilbase CVEConnect your agent

VMware Workspace ONE Access, Identity Manager and vRealize Automation.

Not in CISA KEVCVE-2022-22958

Not confirmed exploited. 1 of 8 rule sources name it.

Edge rules
1/8
Our test
No exploit yet
CVSS
—
EPSS
3.1% Top 12%
Posts, 14d
02026-10-21: 0 posts2026-10-22: 0 posts2026-10-23: 0 posts2026-10-24: 0 posts2026-10-25: 0 posts2026-10-26: 0 posts2026-10-27: 0 posts2026-10-28: 0 posts2026-10-29: 0 posts2026-10-30: 0 posts2026-10-31: 0 posts2026-11-01: 0 posts2026-11-02: 0 posts2026-11-03: 0 posts
Published
2022-04-13
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of… More

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.

Ask Vigil

AI · answers from this page
Ask about CVE-2022-22958: who's covered, what to patch first, how vendors compare. I cite sources and won't help with attacks.

Workers AI (Llama 3.3). Can be wrong: check the cited source.

Public exploits

None found
0 Metasploit0 Exploit-DB0 Scanner template0 GitHub PoCs

No exploit in Exploit-DB or Metasploit, and no scanner template. That lowers, but doesn't remove, the chance of mass exploitation.

Timeline

  1. 2022-04-13
    CVE published
    CVE List
  2. 2023-01-17
    F5 ships a rule
    VMware Workspace ONE Access JDBC Remote Code Execution

Social

2026-10-21: 0 posts2026-10-22: 0 posts2026-10-23: 0 posts2026-10-24: 0 posts2026-10-25: 0 posts2026-10-26: 0 posts2026-10-27: 0 posts2026-10-28: 0 posts2026-10-29: 0 posts2026-10-30: 0 posts2026-10-31: 0 posts2026-11-01: 0 posts2026-11-02: 0 posts2026-11-03: 0 posts

No posts seen yet on X, Bluesky, Mastodon, Hacker News or GitHub.

Vendor statements

Quoted
CloudflareWAF Managed RulesBefore feed history

The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.

AWSAWS WAF Managed RulesNo public claim

We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. AWS often describes a vulnerability without naming its CVE (for example "Log4j"). We count only entries that name the CVE, so AWS coverage is understated.

Microsoft AzureFront Door and Application Gateway WAF (DRS)No public claim

We found no public statement from this vendor naming this CVE. That is not proof of no protection: generic rules may still catch it. The rule tables name CVEs but carry no dates, so Azure is left out of every time-to-rule figure.

Google CloudCloud Armor preconfigured WAF rulesBefore feed history

The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.

FastlyNext-Gen WAF virtual patchesBefore feed history

The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.

F5Attack signatures (Distributed Cloud WAF)5 quotesRule published

First rule 2023-01-17, 279 days after the CVE was published.

2023-01-17New rule200103292Source
Added: signature 200103292 "VMware Workspace ONE Access JDBC Remote Code Execution" (Command Execution, risk High), systems: Other Web Server. References: CVE-2022-22957, CVE-2022-22958, CVE-2022-22959.
2023-01-17New rule200104819Source
Added: signature 200104819 "Java code injection - com.vmware.licensecheck.LicenseChecker (Parameter)" (Server Side Code Injection, risk High), systems: Java Servlets/JSP, Other Web Server. References: CVE-2022-22957, CVE-2022-22958.
2023-01-17New rule200104820Source
Added: signature 200104820 "Java code injection - com.vmware.licensecheck.LicenseChecker" (Server Side Code Injection, risk High), systems: Java Servlets/JSP, Other Web Server. References: CVE-2022-22957, CVE-2022-22958.
2023-01-17New rule200104821Source
Added: signature 200104821 "Java code injection - com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor (Parameter)" (Server Side Code Injection, risk High), systems: Java Servlets/JSP, Other Web Server. References: CVE-2022-22958, CVE-2022-22957.
2023-01-17New rule200104822Source
Added: signature 200104822 "Java code injection - com.mysql.jdbc.interceptors.ServerStatusDiffInterceptor" (Server Side Code Injection, risk High), systems: Java Servlets/JSP, Other Web Server. References: CVE-2022-22958, CVE-2022-22957.
AkamaiApp & API Protector (Adaptive Security Engine)No public source

This vendor publishes no machine-readable rule changelog we can check.

OWASP CRSCore Rule Set (open source, used inside many WAFs)Before feed history

The CVE predates the oldest entry in this vendor's public feed, so a rule may exist that we cannot see.