Critical 9.1Known exploited (CISA KEV)Published Nov 23, 2020

CVE-2020-4006VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

Updated under an hour ago (Oct 29, 2026, 3:10 PM ET)

Does this affect you?

It affects vmware identity_manager and 4 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Nov 3, 2021; federal agencies had to remediate by May 3, 2022. Treat that date as your deadline.

Do this next

Start free and add your stackFree account, 3 products Every CVE for vmware identity_manager Exploited in the last 30 days

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

CVSS: 9.1 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-78
Known exploited: Added to CISA KEV Nov 3, 2021; federal remediation due May 3, 2022Apply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 17.30% (percentile 97)
Assigned by: vmware
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

vmware identity_manager vmware:identity_manager	3.3.1; 3.3.2; 3.3.3	NVD
vmware identity_manager_connector vmware:identity_manager_connector	3.3.1; 3.3.2; 3.3.1; 3.3.2; 3.3.3	NVD
vmware one_access vmware:one_access	20.01; 20.10	NVD
vmware cloud_foundation vmware:cloud_foundation	4.0; 4.0.1	NVD
vmware vrealize_suite_lifecycle_manager vmware:vrealize_suite_lifecycle_manager	from 8.0 through 8.2	NVD

References

References

https://www.vmware.com/security/advisories/VMSA-2020-0027.html	x-refsource-misc, vendor-advisory
https://www.kb.cert.org/vuls/id/724367	third-party-advisory, us-government-resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-4006	us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.