Active Exploitation of Workspace ONE UEM SSRF (CVE‑2021‑22054) Threatens Enterprise Mobility Management
What It Is – A server‑side request forgery (SSRF) flaw in Omnissa Workspace ONE UEM (formerly VMware Workspace ONE UEM) allows an unauthenticated attacker to coerce the management server into making arbitrary HTTP requests on its behalf. The vulnerability carries a CVSS v3.1 base score of 7.5.
Exploitability – The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has placed CVE‑2021‑22054 in its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. No public PoC is required; attackers are leveraging the flaw to pivot inside corporate networks.
Affected Products – Omnissa Workspace ONE UEM (all supported versions prior to the vendor‑issued patch). CISA’s advisory also flags separate, actively‑exploited flaws in SolarWinds and Ivanti solutions, underscoring a broader supply‑chain risk.
TPRM Impact –
- Third‑party mobility‑management platforms are a common foothold for attackers targeting downstream customers.
- Successful SSRF can expose internal APIs, credentials, or enable ransomware staging, creating a cascade of risk across the supply chain.
Recommended Actions –
- Patch Immediately – Apply the vendor’s security update for CVE‑2021‑22054 to all Workspace ONE UEM instances.
- Network Segmentation – Isolate management servers from the internet and restrict outbound traffic to known destinations.
- Log Monitoring – Enable detailed request‑logging on the UEM console and alert on anomalous outbound connections.
- Vendor Coordination – Verify that any SolarWinds or Ivanti products in use are also patched per CISA’s KEV list.
- Risk Re‑assessment – Re‑evaluate the criticality of the UEM service in your third‑party risk register and adjust contractual security clauses accordingly.