Read the docs
TI-2018-05101 Aliases CVE-2018-6979GHSA-x3h9-mvmc-w828

The VMware Workspace ONE Unified Endpoint Management Console (A/W Console) 9.7.x prior to…

Priority LOW 35Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

The VMware Workspace ONE Unified Endpoint Management Console (A/W Console) 9.7.x prior to 9.7.0.3, 9.6.x prior to 9.6.0.7, 9.5.x prior to 9.5.0.16, 9.4.x prior to 9.4.0.22, 9.3.x prior to 9.3.0.25, 9.2.x prior to 9.2.3.27, and 9.1.x prior to 9.1.5.6 contains a SAML authentication bypass vulnerability which can be leveraged during device enrollment. This vulnerability may allow for a malicious actor to impersonate an authorized SAML session if certificate-based authentication is enabled. This vulnerability is also relevant if certificate-based authentication is not enabled, but the outcome of exploitation is limited to an information disclosure (Important Severity) in those cases.

Why it matters now

EPSS 0.01089 65th percentileScored 2026-11-07
Fix Fixed VMware Workspace ONE Unified Endpoint Management Console (AirWatch Console) (VMware): 9.7.0.8, 9.6.0.8, 9.5.0.17 +4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareVMware Workspace ONE Unified Endpoint Management Console (AirWatch Console)9.7 to before 9.7.0.8; 9.6 to before 9.6.0.8; 9.5 to before 9.5.0.17; 9.4 to before 9.4.0.23; 9.3 to before 9.3.0.25; 9.2 to before 9.2.3.28; 9.1 to before 9.1.5.69.7.0.8, 9.6.0.8, 9.5.0.17, 9.4.0.23, 9.3.0.25, 9.2.3.28, 9.1.5.6Patch availableCNA
  • VMware Workspace ONE Unified Endpoint Management Console (AirWatch Console) VendorVMware Affected 9.7 to before 9.7.0.8; 9.6 to before 9.6.0.8; 9.5 to before 9.5.0.17; 9.4 to before 9.4.0.23; 9.3 to before 9.3.0.25; 9.2 to before 9.2.3.28; 9.1 to before 9.1.5.6 Fixed in 9.7.0.8, 9.6.0.8, 9.5.0.17, 9.4.0.23, 9.3.0.25, 9.2.3.28, 9.1.5.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:airwatch_console:*:*:*:*:*:*:*:*9.1.0.0 to before 9.1.5.6; 9.2.0.0 to before 9.2.3.27; 9.3.0.0 to before 9.3.0.25; 9.4.0.0 to before 9.4.0.22; 9.5.0.0 to before 9.5.0.16; 9.6.0.0 to before 9.6.0.7; 9.7.0.0 to before 9.7.0.3VulnerableVMware
  • cpe:2.3:a:vmware:airwatch_console:*:*:*:*:*:*:*:* Versions 9.1.0.0 to before 9.1.5.6; 9.2.0.0 to before 9.2.3.27; 9.3.0.0 to before 9.3.0.25; 9.4.0.0 to before 9.4.0.22; 9.5.0.0 to before 9.5.0.16; 9.6.0.0 to before 9.6.0.7; 9.7.0.0 to before 9.7.0.3 Vulnerable ·VMware

Remediation

  • Fix · CNA VMware Workspace ONE Unified Endpoint Management Console (AirWatch Console) (VMware) Fixed in 9.7.0.8, 9.6.0.8, 9.5.0.17, 9.4.0.23, 9.3.0.25, 9.2.3.28, 9.1.5.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-6979
  2. 2026-10-03 Alias added: GHSA-x3h9-mvmc-w828

References

Advisory 1

  • TI-2017-03074 VMware AirWatch Console (AWC) contains a Broken Access Control vulnerability. CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences