---
id: "CVE-2020-4006"
kind: "vulnerability"
aliases: ["CVE-2020-4006"]
title: "VMware Multiple Products: Multiple VMware Products Command Injection Vulnerability"
severity: "critical"
cvss: 9.1
epss: 0.17302
exploited: true
status: "open"
category: "vendor"
products: [{"name": "VMware Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "VMware Workspace One Access", "fixed": ["KB81754"], "affected": "20.01, 20.10 (Linux)", "ecosystem": "vendor"}, {"name": "VMware Identity Manager", "fixed": ["KB81754"], "affected": "3.3.1, 3.3.2, 3.3.3 (Linux)", "ecosystem": "vendor"}, {"name": "VMware Identity Manager Connector", "fixed": ["KB81754"], "affected": "19.03.0.0, 19.03.0.1, 3.3.1, 3.3.2, 3.3.3", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "identity-manager", "self-hosted", "vendor", "vidm", "vmware", "workspace-one-access"]
not_affected_if: ["managed-hosting", "no-configurator-exposure"]
published_at: "2020-11-23T22:15:12+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:51:46+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-4006", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-4006", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4006", "first_seen_at": "2026-10-23T19:35:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:51:46+00:00"}]
---

# VMware Multiple Products: Multiple VMware Products Command Injection Vulnerability

Command injection in the administrative configurator (port 8443) of VMware Workspace One Access, Identity Manager and their connectors, plus Cloud Foundation and vRealize Suite Lifecycle Manager when they deploy vIDM. An attacker with network access to 8443 and the configurator admin password can run commands as root on the OS. Reported by the NSA. VMware rates it Important (CVSS 7.2) because the password is needed, but CISA lists it as exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VMware Multiple Products affected ? fixed ?
- vendor:VMware Workspace One Access affected 20.01, 20.10 (Linux) fixed KB81754
- vendor:VMware Identity Manager affected 3.3.1, 3.3.2, 3.3.3 (Linux) fixed KB81754
- vendor:VMware Identity Manager Connector affected 19.03.0.0, 19.03.0.1, 3.3.1, 3.3.2, 3.3.3 fixed KB81754

## How to check

Check whether your Workspace One Access or vIDM appliance is on an affected version: Access 20.01 or 20.10 (Linux); vIDM 3.3.1, 3.3.2 or 3.3.3 (Linux); vIDM Connector 19.03.0.0, 19.03.0.1, 3.3.1, 3.3.2 or 3.3.3 (Linux or Windows). Cloud Foundation 4.x and vRealize Suite LifecycleManager 8.x are affected through their embedded vIDM. Then check whether port 8443 (the configurator) is reachable from untrusted networks, and whether KB81754 has been applied. Access Connector 20.01 and 20.10 on Windows is unaffected.

## Fix

Apply the KB81754 patch (https://kb.vmware.com/s/article/81754). The vendor gives no new version numbers. If you cannot patch yet, apply the KB81731 workaround. Block access to port 8443 from untrusted networks, and rotate the configurator admin password.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-4006
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-4006
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-4006
- 2026-10-23T20:51:46+00:00 analyst — Read VMSA-2020-0027.2 (primary). Fix is the KB81754 patch, not a version number; workaround KB81731. Vendor severity Important 7.2 (requires configurator admin password); exploited per CISA KEV. PoC link not checked.

## Documents

- [advisory] VMSA-2020-0027.2 (VMware/Broadcom) https://www.vmware.com/security/advisories/VMSA-2020-0027.html

## From the sources

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_