CVE-2021-22054High· 7.5▾ Abyssal⚠ Exploited in the wildPoC availableVMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access t…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 41.3 · likelihood 19.9 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Mar 23, 2026
Last analysed / modified upstream
100%
1 GitHub repo · Nuclei ×1 (last check)
Added to the CISA catalog on Mar 9, 2026. Federal remediation due Mar 23, 2026. View catalog ↗
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.
workspace_one_uem_console >= 20.0.8.0, < 20.0.8.36workspace_one_uem_console >= 20.11.0.0, < 20.11.0.40workspace_one_uem_console >= 21.2.0.0, < 21.2.0.27workspace_one_uem_console >= 21.5.0.0, < 21.5.0.37Upgrade past the affected range:
workspace_one_uem_console 21.5.0.37Connected by shared product, vendor, weakness, or advisory.
CVE-2021-21985Critical· 9.8The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server
CVE-2021-21975High· 7.5Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal…
CVE-2026-59310Critical· 9.8vCenter directory-traversal vulnerability
CVE-2021-26855Critical· 9.1Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-34473Critical· 9.1Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2024-21893High· 8.2A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without auth…