CVE-2021-22054
Omnissa Workspace ONE Server-Side Request Forgery
Description
CVE-2021-22054 is a HIGH server-side request forgery (SSRF) vulnerability in the Omnissa Workspace ONE UEM console, carrying a CVSS 3.1 score of 7.5. The vulnerability allows an unauthenticated attacker to send server-side requests and access sensitive information from the UEM console server. Affected versions include 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2026-03-09 with a remediation deadline of 2026-03-23. With an EPSS score of 0.935 (93.5%), this vulnerability has one of the highest exploitation probabilities observed and requires immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | workspace one uem console | >= 20.0.8.0, < 20.0.8.36; >= 20.11.0.0, < 20.11.0.40; >= 21.2.0.0, < 21.2.0.27; >= 21.5.0.0, < 21.5.0.37 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://www.vmware.com/security/advisories/VMSA-2021-0029.html(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22054(US Government Resource)
- https://www.greynoise.io/blog/new-ssrf-exploitation-surge(Third Party Advisory)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
CVE-2021-22054 is classified under CWE-918 — Server-Side Request Forgery (SSRF). SSRF vulnerabilities occur when a web application fetches a remote resource based on user-supplied input without properly validating the destination URL. This allows an attacker to coerce the server into making requests to arbitrary internal or external destinations, potentially accessing internal services, cloud metadata endpoints, administrative interfaces, and other resources that should not be accessible from the internet.
In the context of Omnissa Workspace ONE UEM, an enterprise unified endpoint management platform, SSRF is particularly dangerous. The UEM console server typically resides within a privileged network position with access to internal management infrastructure, device enrollment services, directory services, and potentially cloud provider metadata endpoints. An unauthenticated SSRF vulnerability in this context can allow an external attacker to map internal network topology, access internal services, retrieve cloud instance credentials from metadata APIs, and exfiltrate sensitive configuration data — all without any authentication requirement.
Impact Analysis
CVE-2021-22054 carries a CVSS 3.1 score of 7.5 (HIGH) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Confidentiality (HIGH): The SSRF vulnerability enables an unauthenticated attacker to access sensitive information by directing the UEM console server to make requests to internal resources. This includes potential access to internal service responses, cloud metadata endpoints (such as AWS IMDSv1 at 169.254.169.254), configuration files, directory service data, and other internal resources reachable from the server's network position.
Integrity (NONE): The vulnerability as scored does not directly enable modification of data. However, depending on the internal services reachable via SSRF, indirect integrity impacts through chained attacks are possible.
Availability (NONE): The vulnerability does not directly impact the availability of the UEM console or managed endpoints.
The combination of no authentication requirement, no user interaction, and network-based attack vector with low complexity makes this vulnerability trivially exploitable at scale. The 93.5% EPSS score reflects this reality — nearly all organizations running vulnerable versions should assume they are being actively targeted.
Exploit Maturity
CVE-2021-22054 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog as of 2026-03-09.
Exploit status: The EPSS score of 93.5% places this vulnerability in the highest tier of exploitation probability. Public exploit code and proof-of-concept materials are widely available, making exploitation accessible to attackers of varying skill levels. The unauthenticated nature of the vulnerability significantly lowers the barrier to exploitation.
Ransomware association: SSRF vulnerabilities are commonly used as initial access vectors in multi-stage attacks. While CVE-2021-22054 itself provides information disclosure rather than direct code execution, the leaked credentials and internal access it enables are frequently leveraged for lateral movement in ransomware campaigns.
Attack surface: Any internet-facing Workspace ONE UEM console running affected versions is vulnerable without any authentication requirement. The vulnerability has been known since 2021, giving threat actors years to develop and refine exploitation techniques.
KEV deadline: CISA has set a remediation deadline of 2026-03-23. Given the extremely high EPSS score and long-standing availability of exploits, organizations that have not yet patched should treat this as an emergency.
Remediation
- Apply vendor patches immediately. Update Workspace ONE UEM to patched versions: 20.0.8.37, 20.11.0.40, 21.2.0.27, 21.5.0.37, or later. Consult the Omnissa (formerly VMware) security advisory for specific upgrade guidance.
- Verify all affected instances in your environment. Identify all Workspace ONE UEM console deployments across your infrastructure. Affected versions are 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37. Use asset inventory tools to ensure complete coverage.
- Restrict network access to UEM consoles. Implement network-level access controls to limit who can reach the UEM console. Place the console behind a WAF or reverse proxy that can filter malicious SSRF payloads. Ensure the console is not unnecessarily exposed to the public internet.
- Restrict outbound network access from UEM servers. Implement egress filtering to prevent the UEM server from making requests to internal metadata endpoints (169.254.169.254), internal network ranges, and other sensitive destinations. This limits the impact of SSRF even if the vulnerability exists.
- Rotate credentials accessible from the UEM server. Assume that any credentials, API keys, or tokens accessible from the UEM server's network position may have been compromised. This includes cloud provider credentials obtainable via metadata services, database connection strings, and integration credentials.
- Investigate for prior exploitation. Review UEM console access logs and web server logs for unusual request patterns, particularly requests targeting internal IP addresses or metadata endpoints. Check for unauthorized data access or exfiltration indicators.
Technical Details
CVE-2021-22054 is a HIGH-severity SSRF vulnerability in the Omnissa Workspace ONE UEM console that is remotely exploitable without authentication. The attack complexity is low, no privileges are required, and no user interaction is needed — making this a fully unauthenticated, remotely exploitable vulnerability.
Technical mechanism: The Workspace ONE UEM console contains functionality that processes user-supplied URLs or URL components without adequate validation of the destination. An attacker can craft requests that cause the server to initiate HTTP connections to attacker-specified destinations, including internal network addresses, localhost services, and cloud metadata endpoints. The server's responses to these internal requests are then returned to the attacker, enabling information disclosure from otherwise inaccessible internal resources.
CVSS 3.1 vector analysis (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N): The Network attack vector confirms remote exploitation. Low attack complexity means the SSRF is straightforward to trigger. No privileges or user interaction are required, enabling fully automated scanning and exploitation. The Unchanged scope means the vulnerability's direct impact is confined to data accessible from the UEM server's network position. Confidentiality impact is HIGH due to the potential to access sensitive internal resources, while Integrity and Availability are not directly affected.
Affected versions: Workspace ONE UEM 20.0.8 (prior to 20.0.8.37), 20.11.0 (prior to 20.11.0.40), 21.2.0 (prior to 21.2.0.27), and 21.5.0 (prior to 21.5.0.37).
Frequently Asked Questions
What is CVE-2021-22054?
CVE-2021-22054 is a HIGH-severity (CVSS 7.5) server-side request forgery (SSRF) vulnerability in the Omnissa Workspace ONE UEM console. It allows an unauthenticated remote attacker to make the server send requests to internal resources and access sensitive information. It is actively exploited and listed in CISA's KEV catalog.
Which versions of Workspace ONE UEM are affected?
Affected versions are 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37. Organizations should update to the corresponding patched versions or later.
How do I fix CVE-2021-22054?
Update Workspace ONE UEM to a patched version (20.0.8.37, 20.11.0.40, 21.2.0.27, or 21.5.0.37 or later). Additionally, restrict network access to the UEM console, implement egress filtering to limit outbound requests from the server, and rotate any credentials accessible from the server's network position.
How severe is CVE-2021-22054?
CVE-2021-22054 is rated HIGH with a CVSS score of 7.5 and an exceptionally high EPSS score of 93.5%, placing it among the most actively exploited vulnerabilities tracked. It requires no authentication, making it trivially exploitable. The CISA KEV remediation deadline is 2026-03-23.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.