Read the docs
TI-2023-07274 Aliases CVE-2023-20855GHSA-3hq4-5qpg-7776

XML external entity injection in VMware vRealize Orchestrator, VMware vRealize…

Priority MEDIUM 43CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01265 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—VMware vRealize Orchestrator, VMware vRealize Automation, VMware Cloud FoundationVMware vRealize Orchestrator 8.x—No fix listedCNA
  • VMware vRealize Orchestrator, VMware vRealize Automation, VMware Cloud Foundation Vendor— Affected VMware vRealize Orchestrator 8.x Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:vmware:vrealize_automation:*:*:*:*:*:*:*:*8.0 to before 8.11.1VulnerableVMware
cpe:2.3:a:vmware:vrealize_orchestrator:*:*:*:*:*:*:*:*8.0 to before 8.11.1VulnerableVMware
  • cpe:2.3:a:vmware:vrealize_automation:*:*:*:*:*:*:*:* Versions 8.0 to before 8.11.1 Vulnerable ·VMware
  • cpe:2.3:a:vmware:vrealize_orchestrator:*:*:*:*:*:*:*:* Versions 8.0 to before 8.11.1 Vulnerable ·VMware

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-20855
  2. 2026-10-03 Alias added: GHSA-3hq4-5qpg-7776

References

Patch 1

  • TI-2022-07131 Code injection in VMware Workspace ONE Access and Identity Manager KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07137 Incorrect permission assignment in VMware Workspace ONE Access, Identity Manager and… KEVCVSS 3.1HIGH 7.8
  • TI-2022-07149 VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an… CVSS 3.1CRITICAL 9.8
  • TI-2022-07133 Improper authentication in VMware Workspace ONE Access CVSS 3.1CRITICAL 9.8
  • TI-2022-07132 VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955… CVSS 3.1CRITICAL 9.8
  • TI-2017-03078 Deserialization of untrusted data in VMware vRealize Automation CVSS 3.0CRITICAL 9.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences