CVE-2021-22054 – High‑Severity Server‑Side Request Forgery in VMware Workspace ONE UEM
Key Takeaways
- Severity: High (CVSS 7.5)
- Impact: Unauthenticated SSRF allowing attackers to reach internal services.
- Affected: VMware Workspace ONE UEM console versions before the patches listed.
- Current threat: Added to CISA KEV with confirmed active exploitation.
- Action: Apply patch immediately or enforce strict egress filtering.
Overview
The CVE-2021-22054 vulnerability is a pre‑authentication Server‑Side Request Forgery (SSRF) flaw in the VMware Workspace ONE UEM console. It carries a CVSS v3.1 base score of 7.5 (High) and enables unauthenticated attackers to issue arbitrary HTTP requests from the console to internal network resources. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) listed the flaw in its Known Exploited Vulnerabilities (KEV) catalog on 2026‑03‑09, citing active exploitation in the wild. Independent threat‑intel scoring (EPSS) assigns a 93.79 % likelihood of exploitation, underscoring the urgency.
Technical Details
- The UEM console accepts a URL parameter that is fetched server‑side without proper validation or authentication.
- Because the request is performed by the console’s backend, an attacker can force the server to contact internal services (e.g., metadata endpoints, internal APIs, or other protected resources) that are otherwise unreachable from the Internet.
- The flaw is classified as CWE‑918 (SSRF) and is exploitable without any credentials (PR:N in the CVSS vector).
- Exploitation typically involves sending a crafted request to the console’s endpoint, causing it to relay the attacker‑controlled URL. Successful exploitation can lead to data exfiltration, internal network scanning, or pivoting to further attacks.
Severity & Impact
| Metric | Value |
|---|---|
| CVSS v3.1 | 7.5 (High) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CWE | CWE‑918 (SSRF) |
| EPSS | 93.79 % (high likelihood of exploitation) |
| CISA KEV | Added 2026‑03‑09; active exploitation reported |
Affected Products
The vulnerability affects the VMware Workspace ONE UEM console in the following version ranges:
- 20.0.8 < 20.0.8.37
- 20.11.0 < 20.11.0.40
- 21.2.0 < 21.2.0.27
- 21.5.0 < 21.5.0.37
For the complete list of affected versions and additional product details, see the VulnSocial CVE page.
Actionable Insights
- Monitor outbound HTTP traffic from the UEM console for unexpected destinations or internal IP ranges.
- Enable detailed request logging on the console and forward logs to a SIEM for anomaly detection.
- Correlate any observed SSRF attempts with threat‑intel feeds; real‑time signals are available on the VulnSocial CVE page.
- Review firewall and egress filtering rules to block the console from reaching sensitive internal services unless explicitly required.
Remediation & Mitigation
- Identify the installed version of the Workspace ONE UEM console.
- Apply the vendor patch released in VMware Security Advisory VMSA‑2021‑0029:
https://www.vmware.com/security/advisories/VMSA-2021-0029.html - If immediate patching is not feasible, mitigate by:
- Restricting outbound traffic from the console to only trusted destinations.
- Implementing a web‑application firewall rule that validates and blocks suspicious URL parameters.
- Follow CISA’s recommended actions: apply mitigations per vendor guidance or discontinue use of the vulnerable component if mitigations are unavailable.
- Validate the remediation by scanning for the CVE after patch deployment and confirming that the vulnerable endpoint no longer processes external URLs.
Bottom Line
CVE-2021-22054 is a High‑severity SSRF flaw in VMware Workspace ONE UEM that is actively exploited in the wild. Organizations should prioritize patching to the fixed versions or, where patching is delayed, enforce strict egress controls and monitor for suspicious activity.
References
- VMware Security Advisory VMSA‑2021‑0029 – Patch information and remediation guidance. https://www.vmware.com/security/advisories/VMSA-2021-0029.html
- CISA Known Exploited Vulnerabilities catalog entry for CVE-2021-22054. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22054
- GreyNoise analysis of the recent SSRF exploitation surge. https://www.greynoise.io/blog/new-ssrf-exploitation-surge
#CVE202122054 #CVE #SSRF #VMware #WorkspaceONE #CISAKEV #HighSeverity