Read the docs
TI-2021-05093 Aliases CVE-2021-22054GHSA-xqxh-cq77-r6qh

Server-side request forgery in VMware Workspace ONE UEM console

Priority CRITICAL 92Exploited in the wildCWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.

Why it matters now

Exploitation Active In CISA KEV since 2026-03-09CISA due date 2026-03-23
EPSS 0.99677 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—VMware Workspace ONE UEM consoleVMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37.—No fix listedCNA
  • VMware Workspace ONE UEM console Vendor— Affected VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37. Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:workspace_one_uem_console:*:*:*:*:*:*:*:*20.0.8.0 to before 20.0.8.36; 20.11.0.0 to before 20.11.0.40; 21.2.0.0 to before 21.2.0.27; 21.5.0.0 to before 21.5.0.37VulnerableVMware
  • cpe:2.3:a:vmware:workspace_one_uem_console:*:*:*:*:*:*:*:* Versions 20.0.8.0 to before 20.0.8.36; 20.11.0.0 to before 20.11.0.40; 21.2.0.0 to before 21.2.0.27; 21.5.0.0 to before 21.5.0.37 Vulnerable ·VMware

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-03-09 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2021-22054
  3. 2026-10-03 Alias added: GHSA-xqxh-cq77-r6qh

References

Patch 1

Advisory 1

  • TI-2025-18899 Path traversal in Omnissa Workspace ONE UEM CVSS 3.1HIGH 7.5
  • TI-2025-18901 Omnissa Secure Email Gateway (SEG) updates address Server-Side Request Forgery (SSRF) vulnerability CVSS 3.1HIGH 8.6
  • TI-2026-18412 Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability. CVSS 3.1HIGH 7.8
  • TI-2026-18411 Omnissa Workspace ONE® Assist for macOS contains a Local Privilege Escalation Vulnerability. CVSS 3.1HIGH 7.8
  • TI-2025-18898 Improper privilege management in Omnissa Horizon Client for Windows CVSS 3.1HIGH 7.8
  • TI-2024-10629 Incorrect default permissions in Omnissa Horizon Client for MacOS CVSS 3.1HIGH 7.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences