$ cve CVE-2020-4006 JSON

CVE-2020-4006 KEV

9.1

CRITICAL · CVSS 3.1 · EPSS 17.3% (pctl 97)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-03.

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

CVSS	9.1 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS	17.3% — more likely to be exploited than 97% of all CVEs
Weakness	CWE-78
On CISA KEV	yes — remediate by 2022-05-03
Public exploit	none known
Published	2020-11-23
Last modified	2026-06-17

Name	Multiple VMware Products Command Injection Vulnerability
Added	2021-11-03
Due	2022-05-03
Vendor / product	VMware / Multiple Products
Ransomware use	none reported

Vendor	Product
linux	linux kernel
microsoft	windows
vmware	cloud foundation
vmware	identity manager
vmware	identity manager connector
vmware	one access
vmware	vrealize suite lifecycle manager