Workspace ONE Tunnel CVE-2026-22927

Exploitation requires the attacker to already hold local, low-privileged authenticated access (CVSS PR:L, AV:L) on a Windows endpoint where the Omnissa Workspace ONE Tunnel client for Windows is installed and running as a privileged service; no user interaction is needed (UI:N). Limiting factors: the attack cannot be launched remotely or unauthenticated, it is Windows-specific and product-specific, and it depends on the Tunnel service being present and active on the target - so devices without the Tunnel client, or where the attacker has no local foothold, are not exposed.

The CVSS 3.1 base of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a locally exploitable, low-complexity flaw requiring existing low-level privileges and no user interaction, with high impact to all three security properties - internally consistent with a local privilege-escalation primitive. No EPSS score, SSVC decision, KEV entry, or public POC was provided, so there is no evidence of active or automatable exploitation at this time; this is a high-CVSS escalation-class issue rather than a mass-exploitation remote flaw. Realistic priority is elevated on multi-user or shared Windows endpoints and high-value managed devices, where an attacker landing as a standard user could pivot to SYSTEM, but lower on single-user devices where the user is already effectively privileged. Missing data to note: no exact fixed version, EPSS, or exploit-maturity signal is present in the input, so widespread-exploitation likelihood cannot be quantified.

An attacker who already has a standard low-privileged account or code execution on a Windows device running Workspace ONE Tunnel supplies a crafted file path that escapes the intended directory, causing the privileged Tunnel service to write or overwrite a file it should not. By redirecting that write to a location loaded or executed by SYSTEM, the attacker escalates from a normal user to full system privileges; no public POC is currently identified.