Vulnerability intelligence
CVE-2021-22054
Omnissa Workspace ONE Server-Side Request Forgery
Omnissa Workspace One UEM
Omnissa Workspace One UEM formerly known as VMware Workspace One UEM contains a server-side request forgery (SSRF) vulnerability that could allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
CVSS Score
—
Unrated
EPSS — Exploit Probability
97%
Riskier than 100% of all CVEs · checked 2026-09-04
Exploitation
Confirmed in the wild
KEV since 2026-03-09
Remediation
Unconfirmed
Federal deadline 2026-03-23
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-23.
5 articles across 5 outlets · first covered Mar 9, 2026 · latest Mar 10, 2026
Coverage timeline
-
CISA adds Ivanti CVE-2026-1603 auth bypass to KEV, patch nowwww.securityweek.com · Mar 10, 2026
-
CISA Adds KEV Flaws CVE-2021-22054 CVE-2025-26399 CVE-2026-1603securityaffairs.com · Mar 10, 2026
-
CISA flags KEV amid active exploits CVE-2025-26399 CVE-2026-1603thehackernews.com · Mar 10, 2026
-
CVE-2021-22054 Omnissa Workspace One SSRF flaw could expose datawww.cisa.gov · Mar 9, 2026
-
Omnissa Workspace One UEM SSRF CVE-2021-22054 hits KEVcisa.gov · Mar 9, 2026