ZeroDay Findings
Sign inSign up

Findings

CVE-2020-4006

Multiple VMware Products Command Injection Vulnerability

Published Nov 23, 2020 · updated Jun 16, 2026 · vmware identity manager

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 23, 2020 · Catalog

    Detected

    VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe vmware/cloud foundation4.0
  • cpe vmware/identity manager3.3.1
  • cpe vmware/identity manager3.3.2
  • cpe vmware/identity manager3.3.3
  • cpe vmware/identity manager connector3.3.1
  • cpe vmware/identity manager connector3.3.2
  • cpe vmware/one access20.01
  • cpe vmware/one access20.10
  • vendor VMware Multiple Productsversion unspecified

Sources

  • CISA KEVCVE-2020-4006

    VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.

    cisa.gov
  • CVE.orgCVE-2020-4006

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-4006

    30-day exploitation probability 17.3%

    first.org
  • NIST NVDCVE-2020-4006

    VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

    nvd.nist.gov

References