VMware Workspace ONE UEM SSRF Vulnerability CVE-2021-22054
Summary
CISA has added VMware Workspace ONE UEM console versions to the Known Exploited Vulnerabilities (KEV) catalog due to an SSRF vulnerability (CVE-2021-22054). This vulnerability may allow a malicious actor to gain access to sensitive information.
What changed
CISA has added specific versions of VMware Workspace ONE UEM console to its Known Exploited Vulnerabilities (KEV) catalog, identifying CVE-2021-22054 as a Server-Side Request Forgery (SSRF) vulnerability. The affected versions include 20.0.8 prior to .37, 20.11.0 prior to .40, 21.2.0 prior to .27, and 21.5.0 prior to .37. Successful exploitation allows a malicious actor with network access to send unauthenticated requests and potentially access sensitive information.
Organizations using the affected VMware Workspace ONE UEM console versions are strongly advised to review CISA's KEV catalog and the provided VMware security advisory. Prompt patching or mitigation is critical to prevent exploitation. Failure to address this vulnerability could lead to unauthorized access to sensitive data and further compromise of the IT environment.
What to do next
- Review CISA's Known Exploited Vulnerabilities (KEV) catalog for CVE-2021-22054.
- Apply necessary patches or mitigations to affected VMware Workspace ONE UEM console versions as per VMware's security advisory VMSA-2021-0029.
- Assess potential impact and implement additional security controls if patching is not immediately feasible.
Source document (simplified)
Required CVE Record Information
CNA: VMware by Broadcom
Description
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
Product Status
Learn more Versions 1 Total
Default Status: unknown
affected
- affected at VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37.
References 1 Total
CVE Program
Updated:
2024-08-03
This container includes required additional information provided by the CVE Program for this vulnerability.
References 1 Total
Authorized Data Publishers
CISA-ADP
Updated:
2026-03-11
SSVC and KEV, plus CVSS and CWE if not provided by the CNA.
SSVC 1 Total
Learn more
| Exploitation | Automatable | Technical Impact | Version | Date Accessed |
| --- | --- | --- | --- | --- |
| active | yes | total | 2.0.3 | 2021-12-20 |
KEV 1 Total
Learn more
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22054 (2026-03-09)
CWE 1 Total
Learn more
- CWE-918: CWE-918 Server-Side Request Forgery (SSRF)
CVSS 1 Total
Learn more
| Score | Severity | Version | Vector String |
| --- | --- | --- | --- |
| 7.5 | HIGH | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Related changes
Source
Classification
Who this affects
Taxonomy
Browse Categories
Get Vulnerability Management alerts
Weekly digest. AI-summarized, no noise.
Free. Unsubscribe anytime.
Get alerts for this source
We'll email you when CISA Known Exploited Vulnerabilities (KEV) publishes new changes.