Read the docs
TI-2022-18267 Aliases CVE-2022-38757GHSA-m96j-4rc7-c9j2

CVE-2022-38757 ZENworks

Priority LOW 35CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform actions (e.g., install a bundle) on a set of managed devices, to be able to exercise these rights on managed devices in the ZENworks zone but which are outside the scope of the administrator. This vulnerability does not result in the administrators gaining additional rights on the managed devices, either in the scope or outside the scope of the administrator.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00901 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Micro FocusZENworks Configuration Management (ZCM)ZENworks 2020 – Update 3a—No fix listedCNA
Micro FocusZENworks Asset ManagementZENworks 2020 – Update 3a—No fix listedCNA
Micro FocusZENworks Endpoint Security Management (ZESM)ZENworks 2020 – Update 3a—No fix listedCNA
Micro FocusZENworks Patch Management (ZPM)ZENworks 2020 – Update 3a—No fix listedCNA
  • ZENworks Configuration Management (ZCM) VendorMicro Focus Affected ZENworks 2020 – Update 3a Fixed in — No fix listed CNA
  • ZENworks Asset Management VendorMicro Focus Affected ZENworks 2020 – Update 3a Fixed in — No fix listed CNA
  • ZENworks Endpoint Security Management (ZESM) VendorMicro Focus Affected ZENworks 2020 – Update 3a Fixed in — No fix listed CNA
  • ZENworks Patch Management (ZPM) VendorMicro Focus Affected ZENworks 2020 – Update 3a Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:microfocus:zenworks:*:*:*:*:*:*:*:*before 2020VulnerableMicro Focus International
cpe:2.3:a:microfocus:zenworks:2020:-:*:*:*:*:*:*2020VulnerableMicro Focus International
cpe:2.3:a:microfocus:zenworks:2020:update1:*:*:*:*:*:*2020 update1VulnerableMicro Focus International
cpe:2.3:a:microfocus:zenworks:2020:update2:*:*:*:*:*:*2020 update2VulnerableMicro Focus International
cpe:2.3:a:microfocus:zenworks:2020:update3:*:*:*:*:*:*2020 update3VulnerableMicro Focus International
cpe:2.3:a:microfocus:zenworks:2020:update3a:*:*:*:*:*:*2020 update3aVulnerableMicro Focus International

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-38757
  2. 2026-10-03 Alias added: GHSA-m96j-4rc7-c9j2

References

Other 3

  • TI-2021-05471 OS command injection in Operation Bridge Reporter. KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05475 Advance configuration exposing Information Leakage vulnerability in Micro Focus Access… KEVCVSS 3.1HIGH 7.5
  • TI-2018-08950 Unauthenticated SQL injection in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 10.0
  • TI-2020-09524 Hard-coded credentials in Micro Focus Application Performance Management CVSS 3.1CRITICAL 9.8
  • TI-2018-08951 Remote Code Execution in Micro Focus Secure Messaging Gateway CVSS 3.0CRITICAL 9.1
  • TI-2020-09523 Arbitrary code execution vulnerability on multiple Micro Focus products CVSS 3.1HIGH 8.8
See all 128 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences