{"id":"omnissa-workspace-one-ssrf-attacks-mar-2026","category":"patch","status":"closed","title":"Omnissa Workspace ONE UEM request-forgery flaw CVE-2021-22054 used in attacks; patches available","tldr":"Attackers are exploiting an old flaw in Omnissa Workspace ONE UEM management servers. Patches have existed since December 2021. Ask whoever manages your organisation’s devices to confirm its server is patched; updating your phone alone does not fix this.","summary":"Omnissa Workspace ONE UEM, formerly VMware Workspace ONE UEM, helps organisations manage computers and mobile devices. CVE-2021-22054 lets an attacker who can reach its management server make it send requests without logging in, potentially exposing sensitive information. VMware released patches in December 2021 and confirmed in April 2022 that those patches and its workarounds prevent exploitation. GreyNoise reported attack attempts in March 2025; CISA formally listed the flaw as exploited on 9 March 2026. That listing does not establish when attacks began or identify victims. Patches remain available, with no subsequent fix failure identified in the sources reviewed through 3 November 2026. Historical version details conflict: VMware’s CVE record gives 20.0.8.37 as the 2008 branch threshold, while BleepingComputer lists 20.8.0.36. Administrators should confirm that branch with Omnissa. BleepingComputer reported an original critical rating of 9.1; NVD currently rates the flaw high, at 7.5.","action":"If your work or family office uses Workspace ONE, ask its IT provider to confirm the UEM management server has the CVE-2021-22054 fix and runs a currently supported release. Have Omnissa confirm the correct patch if it still runs the old 2008 branch, because published build numbers conflict.","product":"Omnissa Workspace ONE UEM management server, formerly VMware Workspace ONE UEM console","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2021-22054"],"tags":["omnissa","vmware","workspace-one","ssrf","actively-exploited","device-management"],"affected":["VMware Workspace ONE UEM console 20.0.8 before 20.0.8.37, as stated in VMware’s CVE record","VMware Workspace ONE UEM console 20.11.0 before 20.11.0.40","VMware Workspace ONE UEM console 21.2.0 before 21.2.0.27","VMware Workspace ONE UEM console 21.5.0 before 21.5.0.37"],"fixed":["20.0.8.37 (VMware CVE record; conflicting historical 2008 build numbering requires confirmation with Omnissa)","20.11.0.40","21.2.0.27","21.5.0.37"],"matches":[],"sources":[{"kind":"advisory","title":"Workspace ONE UEM SSRF CVE-2021-22054 Patch Alert","url":"https://blogs.vmware.com/security/2022/04/workspace-one-uem-ssrf-cve-2021-22054-patch-alert.html","by":"VMware","date":"2022-04-27"},{"kind":"advisory","title":"CVE-2021-22054 — VMware-supplied CVE record","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/22xxx/CVE-2021-22054.json","by":"VMware / CVE Program","date":"2021-12-17"},{"kind":"news","title":"CISA urges VMware admins to patch critical flaw in Workspace ONE UEM","url":"https://www.bleepingcomputer.com/news/security/cisa-urges-vmware-admins-to-patch-critical-flaw-in-workspace-one-uem/","by":"BleepingComputer","date":"2021-12-17"},{"kind":"research","title":"New SSRF Exploitation Surge Serves as a Reminder of 2019 Capital One Breach","url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","by":"GreyNoise","date":"2025-03-11"},{"kind":"advisory","title":"CISA Adds Three Known Exploited Vulnerabilities to Catalog","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/40d66f5/","by":"CISA","date":"2026-03-09"},{"kind":"news","title":"CISA Flags SolarWinds, Ivanti, and Workspace One Vulnerabilities as Actively Exploited","url":"https://thehackernews.com/2026/03/cisa-flags-solarwinds-ivanti-and.html","by":"The Hacker News","date":"2026-03-10"},{"kind":"advisory","title":"CVE-2021-22054 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2021-22054","by":"NIST NVD","date":"2026-10-01"}],"started":"2026-03-09","closed":"2026-03-09","created":"2026-11-03T22:26:56.536Z","updated":"2026-11-03T22:26:56.536Z","cve_notes":[{"cve":"CVE-2021-22054","name":"Server-side request forgery in Workspace ONE UEM","what":"A request-forgery flaw in the Workspace ONE UEM console lets an attacker who can reach the server make requests through it without logging in and potentially obtain sensitive information.","severity":"critical","cvss":9.1}],"timeline":[{"at":"2026-03-09","added":"2026-11-03T22:23:50.754Z","kind":"cisa-added","text":"CISA added CVE-2021-22054 to its Known Exploited Vulnerabilities catalogue, confirming evidence of exploitation. The listing uses the product's current Omnissa name.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/40d66f5/","by":"CISA","patch":null},{"at":"2025-03-09","added":"2026-11-03T22:23:50.754Z","kind":"wider-attacks","text":"GreyNoise observed a surge in attempts against several server-side request forgery flaws, including CVE-2021-22054. Its subsequent report counted roughly 400 attacking IP addresses across the wider campaign, not Workspace ONE alone.","url":"https://www.greynoise.io/blog/new-ssrf-exploitation-surge","by":"GreyNoise","patch":null},{"at":"2022-04-27","added":"2026-11-03T22:23:50.754Z","kind":"other","text":"VMware renewed its patch warning after technical details became public. It confirmed that the December 2021 patches and workarounds prevent exploitation.","url":"https://blogs.vmware.com/security/2022/04/workspace-one-uem-ssrf-cve-2021-22054-patch-alert.html","by":"VMware","patch":null},{"at":"2021-12-16","added":"2026-11-03T22:23:50.754Z","kind":"disclosed","text":"VMware disclosed CVE-2021-22054 and released Workspace ONE UEM console patches. An attacker who could reach the server could obtain sensitive information without logging in.","url":"https://www.bleepingcomputer.com/news/security/cisa-urges-vmware-admins-to-patch-critical-flaw-in-workspace-one-uem/","by":"BleepingComputer","patch":"patched"}],"url":"https://hard.fyi/live/omnissa-workspace-one-ssrf-attacks-mar-2026/","json":"https://hard.fyi/api/live?id=omnissa-workspace-one-ssrf-attacks-mar-2026"}