Russian State-Sponsored Actors Exploit Vulnerability in VMware Products

Summary

The National Security Agency (NSA) issued an advisory regarding Russian state-sponsored threat actors exploiting a vulnerability in VMware Access and VMware Identity Manager products to access protected data. To exploit the vulnerability, threat actors would need to gain access to the web-based management interface of the device and then forge security assertion markup language (SAML) credentials to generate requests appearing to be legitimate. Affected products include VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connectors, with specific product versions.

Recommendations

The NJCCIC recommends users and administrators apply vendor patches immediately after appropriate testing or apply mitigations detailed in the NSA advisory. The risk of exploitation is reduced when using strong, unique passwords, enabling multi-factor authentication, and when the web-based management interface is not publicly accessible from the internet.