CVE-2020-4006VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-4006: Multiple VMware Products Command Injection Vulnerability

Affects VMware Multiple ProductsSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 17.3% chance of exploitation in 30 days – higher than 97% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-4006 (opens in a new tab)

Description

CVE-2020-4006 is a command injection vulnerability affecting multiple VMware products including Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. An attacker with network access to the administrative configurator on port 8443 and valid administrator credentials can execute arbitrary commands with unrestricted privileges on the underlying operating system. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Summary

This vulnerability allows an attacker who has network access to the administrative configurator interface on port 8443 and valid administrator credentials to perform command injection, leading to arbitrary command execution with full OS privileges on affected VMware products. The affected products include Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. The vulnerability is identified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Exploitation requires valid administrative credentials and network access to the configurator port. Known exploitation in the wild has been reported. No patch or remediation details are provided in the source data.

Impact

Successful exploitation allows an attacker to execute arbitrary commands with unrestricted privileges on the underlying operating system of the affected VMware products. This can lead to full system compromise, data theft, or disruption of services. The vulnerability requires valid administrator credentials and network access to port 8443, which limits the attack surface but does not eliminate the risk given the high privileges granted upon exploitation.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict network access to the administrative configurator on port 8443 to trusted administrators only and enforce strong password policies for administrator accounts. Monitor for unauthorized access attempts and consider additional network segmentation to limit exposure.

Weaknesses

CWE-78OS Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:42:47 UTC

Weaknesses

References

Related threats