#ssti

Analysis · May 20, 2026 · Colten Anderson

Server-side template injection: when the page renderer runs the attacker's code

CVE-2022-22954 is a template-injection bug in VMware Workspace ONE Access. A template engine meant to render data into a page rendered attacker input into code execution instead, unauthenticated, on the appliance that brokers your single sign-on. Attackers had an exploit 48 hours after the patch.