CVE-2021-22054: VMware Workspace ONE UEM console unauthenticated SSRF

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw is unauthenticated, network-reachable, high confidentiality impact, listed in CISA KEV with a near-maximum EPSS score, and affects an internet-facing management console.

What it is

The Workspace ONE UEM console contains a server-side request forgery flaw in versions 20.0.8 before 20.0.8.37, 20.11.0 before 20.11.0.40, 21.2.0 before 21.2.0.27, and 21.5.0 before 21.5.0.37. An attacker with network access can send crafted requests without authentication and reach sensitive information. It matters because the console is an internet-facing management plane and the flaw requires no credentials or user interaction.

Impact

An attacker gains the ability to make the server issue requests on their behalf, exposing sensitive information reachable from the UEM console. The CVSS vector shows high confidentiality impact with no integrity or availability effect.

Attack surface

Reached over the network via the UEM console HTTP interface; the CVSS vector AV:N/PR:N/UI:N and the description confirm no authentication and no user interaction are required. Any host that can reach the console is a potential source.

Exploitation

CVE-2021-22054 is listed in CISA KEV with a due date of 2026-03-23, and EPSS shows a 30-day probability of 0.97369 (99.895th percentile), indicating active exploitation is expected or observed. A third-party advisory reference describes an SSRF exploitation surge.

What to do

• Apply the vendor patch by upgrading to 20.0.8.37, 20.11.0.40, 21.2.0.27, or 21.5.0.37 as applicable per VMSA-2021-0029.
• If patching cannot be completed immediately, restrict network access to the UEM console to trusted management networks and remove direct internet exposure.
• Follow CISA KEV required action and BOD 22-01 guidance for cloud services, including discontinuing use if mitigations are unavailable.
• Review and harden outbound egress filtering from the UEM console so it cannot reach internal metadata services or sensitive internal endpoints.
• Monitor vendor advisory VMSA-2021-0029 for any updated guidance.

Detection

• Inspect UEM console and reverse-proxy logs for requests containing absolute URLs, internal hostnames, or cloud metadata addresses (for example 169.254.169.254) in parameters.
• Alert on outbound connections from the UEM console to internal RFC1918 ranges, loopback, or link-local addresses that are not part of normal operation.
• Correlate unauthenticated requests to the UEM console with subsequent access to internal services or unusual response sizes.
• Hunt for known SSRF payload patterns in HTTP request bodies and query strings against the UEM console endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.