CVE-2021-22054

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)

CISA KEV

listed 2026-03-09, due 2026-03-23

CWE

CWE-918

Published

2021-12-17

Modified

2026-10-01

Record from

the NVD, synced 2026-10-19

Affected

• vmware:workspace_one_uem_console

References

• https://www.vmware.com/security/advisories/VMSA-2021-0029.html
• https://www.vmware.com/security/advisories/VMSA-2021-0029.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22054
• https://www.greynoise.io/blog/new-ssrf-exploitation-surge

Check your stackJSON