CVE-2021-22054: Omnissa Workspace ONE Server-Side Request Forgery
Omnissa · Workspace One UEM
No fix listed · Affected: Omnissa Workspace One UEM · Exploitation: in CISA KEV since 9 Mar
ExploitationIn CISA KEV
- In CISA KEVCISA KEV catalogue9 Mar
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub3 Jun 2022
- Not established: not seen
Higher than 99% of scored CVEs
Not scored yet. NVD has not published a CVSS score.
Federal deadline
CISA KEV · added 9 Mar · catalogue entry
Passed 236 days ago
DescriptionNVD
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalogue.
- CISA KEV
- Listed since 9 Mar · catalogue entry
- Public check
- VMWare Workspace ONE UEM - Server-Side Request Forgery · nuclei template in projectdiscovery/nuclei-templates
- Weakness
- Server-Side Request Forgery
- Vendor
- Omnissa
- Published
- December 2021
What changed
- CISA added it to the KEV catalogue CISA
- PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage5 articles · 4 outlets
One row per outlet, in order of first report. First in our coverage: CISA, 9 Mar.
- Mon 9 Mar, 21:20 UTC. CISA, first report. Omnissa Workspace One UEM SSRF CVE-2021-22054 hits KEV. Cites a CVE in CISA KEV.
- Mon 9 Mar, 21:28 UTC. CISA. CVE-2021-22054 Omnissa Workspace One SSRF flaw could expose data. Cites a CVE in CISA KEV.
- Tue 10 Mar, 07:43 UTC. The Hacker News, its first report on the story. CISA flags KEV amid active exploits CVE-2025-26399 CVE-2026-1603. Cites a CVE in CISA KEV.
- Tue 10 Mar, 10:49 UTC. Security Affairs, its first report on the story. CISA Adds KEV Flaws CVE-2021-22054 CVE-2025-26399 CVE-2026-1603. Cites a CVE in CISA KEV.
- Tue 10 Mar, 12:21 UTC. SecurityWeek, its first report on the story. CISA adds Ivanti CVE-2026-1603 auth bypass to KEV, patch now. Cites a CVE in CISA KEV.
- First report
- Article
- Official notice
- Running total
Added to CISA KEV
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 9 Mar 21:20 | CISA | Omnissa Workspace One UEM SSRF CVE-2021-22054 hits KEV |
| 9 Mar 21:28 | CISA | CVE-2021-22054 Omnissa Workspace One SSRF flaw could expose data |
| 10 Mar 07:43 | The Hacker News | CISA flags KEV amid active exploits CVE-2025-26399 CVE-2026-1603 |
| 10 Mar 10:49 | Security Affairs | CISA Adds KEV Flaws CVE-2021-22054 CVE-2025-26399 CVE-2026-1603 |
| 10 Mar 12:21 | SecurityWeek | CISA adds Ivanti CVE-2026-1603 auth bypass to KEV, patch now |
- CISA adds Ivanti CVE-2026-1603 auth bypass to KEV, patch nowSecurityWeek · mentions it in passing
- CISA Adds KEV Flaws CVE-2021-22054 CVE-2025-26399 CVE-2026-1603Security Affairs
- CVE-2021-22054 Omnissa Workspace One SSRF flaw could expose dataCISA · official notice
- Omnissa Workspace One UEM SSRF CVE-2021-22054 hits KEVCISA · official notice · first in our coverage
New articles also arrive in the RSS feed.