VMware Multiple Products Privilege Escalation Vulnerability

A local attacker, with a low-privilege account, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2022-05-06 under CISA BOD 22-01.

This is a Incorrect Permission Assignment (CWE-732) vulnerability in VMware Multiple Products. VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'. Exploitation requires local access, low attack complexity, a low-privilege authenticated account, and no user interaction required.

Probably yes if any of these apply:

Active exploitation documented in the wild. Threat-research write-up: http://packetstormsecurity.com/files/171918/Mware-Workspace-ONE-Remote-Code-Execution.html