What is the CVSS score of CVE-2026-22927?

CVE-2026-22927 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Workspace ONE Tunnel are affected by CVE-2026-22927?

Omnissa Workspace ONE Tunnel for Windows contains a local privilege escalation flaw (CVE-2026-22927) that could allow any user with access to an affected managed endpoint to escalate to SYSTEM-level…

How to fix or mitigate CVE-2026-22927?

Within 24 hours: Inventory all Windows Omnissa Workspace ONE Tunnel installations and document affected versions. Within 7 days: Deploy endpoint detection and response (EDR), application whitelisting, and least-privilege account controls on affected machines. Within 30 days: Monitor Omnissa security advisories for patch availability and prepare staged testing and deployment procedures for immediate rollout when released.

Workspace ONE Tunnel CVE-2026-22927

EUVD-2026-42242 HIGH

Path Traversal (CWE-22)

2026-07-08 de5a6978-88fe-4c27-a7df-d0d5b52d5b52

GHSA-7c7j-678j-gcch

Privilege Escalation Path Traversal Microsoft Workspace One Tunnel

7.8

CVSS 3.1 · Vendor: de5a6978-88fe-4c27-a7df-d0d5b52d5b52

Severity by source

Vendor (de5a6978-88fe-4c27-a7df-d0d5b52d5b52) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local escalation by an already-authenticated low-privileged user (AV:L, PR:L), no interaction, yielding full SYSTEM control of the host (C/I/A:H, scope unchanged).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (de5a6978-88fe-4c27-a7df-d0d5b52d5b52).

CVSS VectorVendor: de5a6978-88fe-4c27-a7df-d0d5b52d5b52

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 14:33 vuln.today

CVE Published

Jul 08, 2026 - 14:16 cve.org

HIGH 7.8

DescriptionCVE.org

Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.

AnalysisAI

Local privilege escalation in Omnissa Workspace ONE Tunnel for Windows lets an authenticated low-privileged local user abuse a path-traversal weakness (CWE-22) to gain higher (likely SYSTEM) privileges on the endpoint. The flaw affects the Windows Tunnel client used for per-app VPN in Workspace ONE managed fleets; no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high across confidentiality, integrity, and availability, but exploitation is confined to attackers who already have a local foothold on the machine.

Technical ContextAI

Workspace ONE Tunnel is the client-side component of Omnissa's (formerly VMware) Workspace ONE UEM platform that provides per-application VPN connectivity for managed Windows devices, typically running as a privileged Windows service. The root cause is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): the service handles file paths without properly constraining them to an intended directory, allowing a lower-privileged user to influence file operations performed in a higher-privilege context. In practice, path-traversal issues in a SYSTEM-level service commonly enable reading, writing, or overwriting files outside the intended scope, which on Windows frequently converts into code execution or privilege escalation.

RemediationAI

Patch available per vendor advisory: update Omnissa Workspace ONE Tunnel for Windows to the fixed release identified in OMSA-2026-0002 (https://www.omnissa.com/omsa-2026-0002); the exact patched version is not specified in the available data and must be taken from that advisory. Because this is a local escalation with no remote trigger, distribute the updated Tunnel client through Workspace ONE UEM as an expedited managed-app update and prioritize shared/multi-user Windows endpoints. As interim compensating controls until patching, restrict interactive and standard-user logon on devices running the Tunnel service, tighten filesystem ACLs on the Tunnel installation and working directories to limit non-admin write access, and monitor for unexpected file writes or anomalous service behavior - noting these controls reduce but do not eliminate the traversal risk and may interfere with legitimate per-app VPN operation.