VMware Workspace ONE UEM console - SSRF (CVE-2021-22054)
Description
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
psychologyCrowdSec Analysis
CVE-2021-22054 is a server-side request forgery (SSRF) vulnerability in VMware Workspace ONE UEM console versions prior to specific patch levels. This flaw allows attackers with network access to the UEM console to send unauthorized requests and potentially access sensitive internal information without authentication. Exploitation of this vulnerability could enable threat actors to pivot within the network or harvest confidential data from internal resources.
CrowdSec has been tracking this vulnerability and its exploits since 8th of April 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2021-22054 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit this vulnerability by sending crafted requests to the /Catalog/BlobHandler.ashx endpoint with a Url parameter, enabling server-side request forgery to access internal resources.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2021-12-17 |
| CISA KEV | 2026-03-09 |
| CISA Remediation Deadline | 2026-03-23 |
| Rule Released | 2026-04-08 |
| CrowdSec First Seen | 2026-04-08 |