This vulnerability in Omnissa Workspace ONE® Tunnel for Windows is classified as CWE-22, indicating improper limitation of a pathname to a restricted directory. This flaw can be exploited locally by an attacker with limited privileges to escalate their privileges on the affected system. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires local access with low complexity and no user interaction, and successful exploitation results in high impact on confidentiality, integrity, and availability. The vendor has published the vulnerability but has not yet provided remediation details or patches. No known exploits have been observed in the wild.

Successful exploitation of this vulnerability allows a local attacker with limited privileges to escalate their privileges, potentially gaining full control over the affected system. This can lead to unauthorized access to sensitive data, modification or destruction of data, and disruption of system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity related to the Workspace ONE® Tunnel application. Avoid executing untrusted code or files in the context of this application.