CVE-2021-22054

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 97.4%; technical severity is CVSS 7.5.

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.

Who should care

• Teams operating Workspace One UEM, Workspace One Uem Console
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Workspace One UEM, Workspace One Uem Console is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. VMware Security patch VMSA-2021-0029
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-918

Affected versions

Omnissa Workspace One UEM; Vmware Workspace One Uem Console (Start Including 20.0.8.0, End Excluding 20.0.8.36 | Start Including 20.11.0.0, End Excluding 20.11.0.40 | Start Including 21.2.0.0, End Excluding 21.2.0.27 | Start Including 21.5.0.0, End Excluding 21.5.0.37)

Fixed versions

Vmware Workspace One Uem Console (Fixed from 20.0.8.36, 20.11.0.40, 21.2.0.27, 21.5.0.37)

Published

17 December 2021

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 17 Dec 2021CVE published
2. 8 Mar 2026Added to CISA KEV
3. 19 Aug 2026Latest EPSS score: 97.4%
4. 19 Aug 2026 · 12:58 UTCSignal calculated at 82

External references

• CISA Government advisory CVE-2021-22054 ↗
• Greynoise Exploit information New Ssrf Exploitation Surge ↗