Loading story…
A pre-authenticated remote code execution flaw in VMware NSX Manager was disclosed as stemming from unsafe deserialization in the bundled XStream library, tracked in part through CVE-2021-39144. Researchers reported that NSX Manager 6.4.13 shipped with xstream-1.4.18.jar and exposed an unauthenticated password-reset API endpoint through an isAnonymous() access rule in Spring Security, allowing attackers to submit crafted XML to a SecurityProfileDto object and trigger code execution without logging in.
The published exploit chain used XStream deserialization with a dynamic-proxy and EventHandler gadget path to invoke ProcessBuilder.start(), achieving command execution as root on the appliance. VMware addressed the issue in advisory VMSA-2022-0027 for affected VMware Cloud Foundation components, while the research noted that some NSX Manager deployments remained effectively unpatched because the impacted product version had reached end of life.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
VMware published security advisory VMSA-2022-0027 covering multiple vulnerabilities in VMware Cloud Foundation. The research write-up identifies this advisory as the relevant VMware patch advisory for the NSX Manager issue, while noting the affected NSX Manager product was effectively unpatched due to end-of-life status.
Sina Kheirkhah of MDSec and Steven Seeley of Source Incite published technical analysis showing pre-authenticated remote code execution in VMware NSX Manager via an anonymous password reset endpoint and unsafe XStream deserialization. The write-up included proof-of-concept exploitation against NSX Manager 6.4.13 resulting in root command execution.
XStream disclosed CVE-2021-39144 for a deserialization vulnerability affecting versions up to 1.4.18. The issue is the underlying flaw later shown to impact VMware NSX Manager through its use of XStream.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
vmware.com
Open sourcesummoning.team
Open sourcex-stream.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Broadcom addressed three high-severity vulnerabilities in VMware products following notification from the National Security Agency (NSA), highlighting the potential national security implications of these flaws. The vulnerabilities, identified as CVE-2025-41250 affecting vCenter Server and CVE-2025-41251 and CVE-2025-41252 affecting VMware NSX, impact a range of VMware products including NSX, NSX-T, VMware Cloud Foundation, VMware vCenter Server, VMware Telco Cloud Platform, and VMware Telco Cloud Infrastructure. Security professionals noted that the NSA's involvement suggests a heightened risk of exploitation by nation-state actors, referencing previous incidents where Russian state-sponsored groups targeted VMware vulnerabilities. The two NSX vulnerabilities allow unauthenticated attackers to enumerate valid usernames on affected systems, which can be leveraged in combination with weak or reused credentials to facilitate deeper network penetration. The vCenter Server vulnerability involves SMTP header injection, which could be used in further attack chains. While there is no public evidence that these specific vulnerabilities have been exploited in the wild, experts warn that their combination could enable attackers to progress from reconnaissance to authenticated compromise. The vulnerabilities were disclosed and patched on September 29, 2025, with Broadcom urging customers to apply updates promptly. In parallel, security researchers at NCC Group have published detailed technical analyses of guest-to-host escape vulnerabilities in VMware Workstation, demonstrating how attackers can exploit information leaks and stack-based buffer overflows to execute code on the host operating system from a compromised guest VM. The research includes proof-of-concept exploit development using tools such as Ghidra and WinDBG, providing valuable insights for red teamers and penetration testers. These findings underscore the ongoing risks associated with virtualization platforms, where vulnerabilities can enable attackers to break out of isolated environments and compromise underlying infrastructure. The technical depth of the NCC Group's research highlights the complexity of exploit development for VMware products and the importance of robust vulnerability management. The combination of newly patched vulnerabilities and active exploit research emphasizes the need for organizations to maintain up-to-date security controls and monitor for signs of suspicious activity in virtualized environments. Security teams are advised to review VMware advisories, apply patches without delay, and consider additional hardening measures for critical systems. The involvement of intelligence agencies in vulnerability disclosure further illustrates the strategic importance of securing virtualization technologies in both enterprise and government contexts. Organizations should also be aware of the potential for these vulnerabilities to be used in targeted attacks, particularly by sophisticated threat actors. Ongoing collaboration between vendors, security researchers, and government agencies remains essential to address emerging threats in the virtualization space.
Jun 29, 2026
Attackers sharply increased exploitation attempts against **CVE-2022-22954**, a critical remote code execution flaw affecting **VMware Workspace ONE Access**, **VMware Identity Manager**, and related products covered by VMware advisory **`VMSA-2022-0011`**. The vulnerability, rated **CVSS 9.8**, was disclosed by VMware as part of updates addressing multiple flaws, and security monitoring showed probing beginning shortly after disclosure before spiking significantly later as attackers intensified scanning and exploitation activity. Observed payloads attempted to execute shell commands that would fetch and run malicious binaries using tools such as `wget` and `curl`, indicating efforts to gain remote control of exposed systems after successful compromise. Monitoring data cited major apparent source locations including **Lithuania** and the **United States**, and defenders were urged to apply VMware’s published patches or mitigations immediately to reduce exposure to active internet exploitation.
Aug 15, 2026
VMware Workspace ONE UEM (formerly AirWatch) is affected by **CVE-2021-22054**, a critical pre-authentication server-side request forgery flaw (CVSS 9.1) in the `BlobHandler.ashx` endpoint used by the AirWatch Console and Catalog applications. Attackers can exploit hardcoded encryption parameters—by selecting key version `kv0`—to create valid encrypted URL parameters that cause a vulnerable UEM server to send arbitrary HTTP requests, including attacker-controlled methods and bodies, to internal or external targets. The publicly exposed `/Catalog/BlobHandler.ashx` endpoint may be reachable even where the administrative console is restricted, enabling access to internal services or cloud metadata endpoints; on AWS-hosted deployments, this could expose IAM-role credentials. VMware issued fixes in VMSA-2021-0029 in December 2021 and later warned that public technical details increased exploitation risk. Organizations that have not patched should apply the vendor updates or mitigations and rotate the static master key according to KB88323.
Sep 3, 2026