Three Actively Exploited Vulnerabilities (CVE‑2021‑22054, CVE‑2025‑26399, CVE‑2026‑1603) Pose Immediate Risk to Enterprise Systems
What It Is — CISA has added three CVEs to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in the wild. The flaws affect VMware Omnissa Workspace ONE (SSRF), SolarWinds Web Help Desk (deserialization), and Ivanti Endpoint Manager (authentication bypass).
Exploitability — All three are being leveraged by threat actors in targeted campaigns; proof‑of‑concept exploits are publicly available. CVSS scores range from 7.5 to 9.8, indicating high to critical severity.
Affected Products —
- Omnissa Workspace ONE – Server‑Side Request Forgery (CVE‑2021‑22054)
- SolarWinds Web Help Desk – Deserialization of Untrusted Data (CVE‑2025‑26399)
- Ivanti Endpoint Manager (EPM) – Authentication Bypass (CVE‑2026‑1603)
TPRM Impact – These vulnerabilities are common entry points for supply‑chain attacks, credential theft, and lateral movement. Third‑party vendors that host or manage these solutions can become vectors for compromise of downstream customers, amplifying risk across multiple industries.
Recommended Actions –
- Prioritize patching of the three CVEs within the BOD 22‑01 remediation window.
- Conduct an inventory to confirm any third‑party services using the affected products.
- Apply compensating controls (e.g., network segmentation, WAF rules) while patches are pending.
- Update vulnerability‑management playbooks to flag KEV catalog entries as “high‑priority”.
- Communicate remediation status to all affected business units and external partners.
Source: CISA Advisory – March 9 2026