The NSA did say that the vulnerability has been exploited as part of an attack that resulted in the attackers gaining access to sensitive data. Based on the disclosure timeline, it’s likely that the security hole was being exploited before a patch was released. In an advisory published on Monday, the NSA said “Russian state-sponsored malicious cyber actors” have been exploiting CVE-2020-4006, but it has not shared any information on the group (or groups) that launched the attacks or any of the targets.

A few days ago, when it announced the availability of patches, the virtualization giant revealed that it learned of the flaw from the NSA, but without mentioning active exploitation. VMware first disclosed the vulnerability on November 23, when it told customers that it had been working on a fix. The vulnerability is tracked as CVE-2020-4006 and it has been found to impact the VMware Workspace ONE Access identity management product and some related components, including Identity Manager (vIDM) on Linux, vIDM Connector on Windows and Linux, VMware Cloud Foundation and vRealize Suite Lifecycle Manager.Īn attacker who has gained access to the system’s web-based management interface can exploit the vulnerability to execute arbitrary commands with elevated privileges on the underlying operating system.

Russian state-sponsored hackers have been exploiting a vulnerability that VMware patched recently in some of its products, the National Security Agency (NSA) warned on Monday.

Vmware horizon hackers are active by