Description
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
CISA Known Exploited Vulnerability
Date added 2026-03-09 | Due date 2026-03-23
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Problem types
VMware Workspace ONE UEM console patches SSRF vulnerability
References
www.vmware.com/security/advisories/VMSA-2021-0029.html
www.greynoise.io/blog/new-ssrf-exploitation-surge
www.cisa.gov/...erabilities-catalog?field_cve=CVE-2021-22054
www.vmware.com/security/advisories/VMSA-2021-0029.html