NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

Omnissa Workspace ONE UEM request-forgery flaw CVE-2021-22054 used in attacks; patches available

Attackers are exploiting an old flaw in Omnissa Workspace ONE UEM management servers. Patches have existed since December 2021. Ask whoever manages your organisation’s devices to confirm its server is patched; updating your phone alone does not fix this.

What to do

If your work or family office uses Workspace ONE, ask its IT provider to confirm the UEM management server has the CVE-2021-22054 fix and runs a currently supported release. Have Omnissa confirm the correct patch if it still runs the old 2008 branch, because published build numbers conflict.

What’s happening

Omnissa Workspace ONE UEM, formerly VMware Workspace ONE UEM, helps organisations manage computers and mobile devices. CVE-2021-22054 lets an attacker who can reach its management server make it send requests without logging in, potentially exposing sensitive information. VMware released patches in December 2021 and confirmed in April 2022 that those patches and its workarounds prevent exploitation. GreyNoise reported attack attempts in March 2025; CISA formally listed the flaw as exploited on 9 March 2026. That listing does not establish when attacks began or identify victims. Patches remain available, with no subsequent fix failure identified in the sources reviewed through 3 November 2026. Historical version details conflict: VMware’s CVE record gives 20.0.8.37 as the 2008 branch threshold, while BleepingComputer lists 20.8.0.36. Administrators should confirm that branch with Omnissa. BleepingComputer reported an original critical rating of 9.1; NVD currently rates the flaw high, at 7.5.

What
Flaw
Affects
Omnissa Workspace ONE UEM management server, formerly VMware Workspace ONE UEM console
Affected
VMware Workspace ONE UEM console 20.0.8 before 20.0.8.37, as stated in VMware’s CVE record
VMware Workspace ONE UEM console 20.11.0 before 20.11.0.40
VMware Workspace ONE UEM console 21.2.0 before 21.2.0.27
VMware Workspace ONE UEM console 21.5.0 before 21.5.0.37
Fixed in
20.0.8.37 (VMware CVE record; conflicting historical 2008 build numbering requires confirmation with Omnissa)
20.11.0.40
21.2.0.27
21.5.0.37
CVE
CVE-2021-22054
Since
9 Mar 2026
Closed
9 Mar 2026

Timeline

  1. CISA added

    CISA added CVE-2021-22054 to its Known Exploited Vulnerabilities catalogue, confirming evidence of exploitation. The listing uses the product's current Omnissa name.

  2. Wider attacks

    GreyNoise observed a surge in attempts against several server-side request forgery flaws, including CVE-2021-22054. Its subsequent report counted roughly 400 attacking IP addresses across the wider campaign, not Workspace ONE alone.

  3. Update

    VMware renewed its patch warning after technical details became public. It confirmed that the December 2021 patches and workarounds prevent exploitation.

  4. Made publicFixed

    VMware disclosed CVE-2021-22054 and released Workspace ONE UEM console patches. An attacker who could reach the server could obtain sensitive information without logging in.

Sources

  1. Workspace ONE UEM SSRF CVE-2021-22054 Patch AlertVMware · 27 Apr 2022
  2. CVE-2021-22054 — VMware-supplied CVE recordVMware / CVE Program · 17 Dec 2021
  3. CISA urges VMware admins to patch critical flaw in Workspace ONE UEMBleepingComputer · 17 Dec 2021
  4. New SSRF Exploitation Surge Serves as a Reminder of 2019 Capital One BreachGreyNoise · 11 Mar 2025
  5. CISA Adds Three Known Exploited Vulnerabilities to CatalogCISA · 9 Mar 2026
  6. CISA Flags SolarWinds, Ivanti, and Workspace One Vulnerabilities as Actively ExploitedThe Hacker News · 10 Mar 2026
  7. CVE-2021-22054 DetailNIST NVD · 1 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from March 2026 · JSON · RSS