Content, Breach, Channel partners

VMware Security Advisory: What MSSPs Need to Know About Vulnerabilities

Old Ladder leading to the light. 3d Render. Freedom concept.

VMware has released an advisory addressing security vulnerabilities found and resolved in several of its products. Customers who use any of the following VMware products may be impacted by the vulnerabilities:

  • Workspace ONE Access
  • VMware Identity Manager (vIDM)
  • vRealize Lifecycle Manager
  • vRealize Automation
  • VMware Cloud Foundation

Multiple vulnerabilities found in these products were privately reported to VMware, the company said. Since that time, patches have been released to mitigate the vulnerabilities.

VMware is encouraging customers who may be affected by the vulnerabilities to patch their products immediately. Furthermore, organizations that use ITIL definitions for change management should consider an "emergency change" to address the vulnerabilities.

Cybercriminals Exploit Vulnerability in VMware Horizon

VMware's security advisory comes after security researchers in February 2022 reported a state-sponsored group, dubbed "TunnelVision," allegedly was exploiting the Log4j vulnerability in the VMware Horizon virtual desktop platform.

TunnelVision was allegedly using Horizon to deliver one-day vulnerabilities to organizations in the United States and Middle East, the researchers stated. To do so, TunnelVision exploited a Log4j vulnerability in the Tomcat service of VMware Horizon to run malicious PowerShell commands, deploy backdoors, create backdoor users, harvest credentials and perform lateral movement.

Along with TunnelVision exploiting Horizon, Russian hackers exploited vulnerabilities in VMware equipment in attacks against governments and aviation networks that took place from September 2020 until at least December 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) indicated. They used these attacks to compromise networks and exfiltrate data from multiple victims.

VMware delivers multi-cloud services to global organizations. It also provides a partner program that lets MSSPs and MSPs use its services to deliver endpoint, workspace and other security offerings.

Dan Kobialka

Dan Kobialka is senior contributing editor, MSSP Alert and ChannelE2E. He covers IT security, IT service provider business strategies and partner programs. Dan holds a M.A. in Print and Multimedia Journalism from Emerson College and a B.A. in English from Bridgewater State University. In his free time, Dan enjoys jogging, traveling, playing sports, touring breweries and watching football.