VMware Workspace ONE UEM Console Unauthenticated Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-22054) Analysis and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTVMware Workspace ONE UEM console versions 20.0.8 (prior to 20.0.8.37), 20.11.0 (prior to 20.11.0.40), 21.2.0 (prior to 21.2.0.27), and 21.5.0 (prior to 21.5.0.37).
An unauthenticated remote attacker with network access to the UEM console can send crafted requests to access sensitive internal resources and information.
Apply the official cumulative patches immediately or implement IIS URL Rewrite rules to block external access to the vulnerable endpoints.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Administrators must apply the cumulative patches provided by VMware in VMSA-2021-0029. Use the following PowerShell command to verify the currently installed version of the Workspace ONE UEM Console DLL to determine if your system is vulnerable.
# Verify the installed Workspace ONE UEM Console version
$UEMPath = 'C:\Program Files\AirWatch\Workspace ONE UEM\AirWatch.Web.Console\bin'
if (Test-Path $UEMPath) {
Get-ItemProperty -Path "$UEMPath\AirWatch.Web.Console.dll" | Select-Object -Property VersionInfo | Format-List
} else {
Write-Host 'Workspace ONE UEM Console path not found. Please check your installation directory.' -ForegroundColor Red
}2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, you can mitigate the risk by configuring an IIS URL Rewrite rule to block external access to the vulnerable endpoints. Add the following configuration block to your IIS web.config file.
<!-- Add this rule inside the <system.webServer> section of your web.config -->
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name='Block_CVE-2021-22054_SSRF' stopProcessing='true'>
<match url='^AirWatch/.*' />
<conditions>
<!-- Block requests targeting the vulnerable endpoint from external sources -->
<add input='{HTTP_HOST}' pattern='^internal\.local$' negate='true' />
<add input='{PATH_INFO}' pattern='(?i)/Catalog/GetImg' />
</conditions>
<action type='CustomResponse' statusCode='403' statusReason='Forbidden' statusDescription='Access Denied by Security Policy' />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>3. Log Audit & IoC Verification Commands
To identify potential exploitation attempts, search the IIS W3C log files for requests containing loopback addresses or private IP ranges within the query parameters of the console endpoints.
# Define the IIS log directory path
$LogPath = 'C:\inetpub\logs\LogFiles\W3SVC1\*.log'
# Search for suspicious SSRF patterns in IIS logs
Select-String -Path $LogPath -Pattern '(?i)(127\.0\.0\.1|localhost|169\.254\.169\.254)' |
Select-Object -Property Path, LineNumber, Line -First 50 |
Format-Table -WrapBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
CVE-2021-22054 is a high-severity Server-Side Request Forgery (SSRF, CWE-918) vulnerability residing in the VMware Workspace ONE UEM (Unified Endpoint Management) console. The root cause lies in the application's failure to properly validate and sanitize user-supplied URL inputs within specific console endpoints. This allows the application to make outbound HTTP requests to arbitrary destinations on behalf of the server.
2. Exploitation Mechanics & Attack Scenario
An attacker with network access to the UEM console can exploit this vulnerability without any prior authentication. In a typical exploitation scenario, the attacker sends a specially crafted HTTP request containing a target internal URL to the vulnerable endpoint. The UEM console processes this request and forwards it to internal systems (such as localhost, internal databases, or cloud metadata services like AWS IMDS) that are otherwise inaccessible from the public internet, returning the sensitive response back to the attacker.
3. Infrastructure & Business Impact
This vulnerability is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. With an EPSS score of 0.9968, scanning and automated exploitation attempts are highly prevalent. Successful exploitation can lead to unauthorized access to internal network topologies, exposure of sensitive configuration data, and potential credential theft, posing a severe risk of lateral movement and full infrastructure compromise.
Official Vendor Advisories & References
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
Frequently Asked SecOps Questions (CVE-2021-22054)
FAQQ1. How critical is CVE-2021-22054 and is it actively exploited in the wild?
CVE-2021-22054 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 99.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-22054?
Primary impacted vendors include vmware across workspace one uem console. Scope summary: VMware Workspace ONE UEM console prior to 20.0.8.37, 20.11.0.40, 21.2.0.27, and 21.5.0.37
Q3. What temporary mitigations or workarounds exist for CVE-2021-22054 before patching?
[Mitigation] Apply the official cumulative patches immediately or implement IIS URL Rewrite rules to block external access to the vulnerable endpoints. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-22054
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (vmware)
View Category →VMware Aria Operations Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-22719)
[Affected Scope] VMware Aria Operations instances with support-assisted product migration in progress
Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)
[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).
VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.