Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation (CVE-2021-22054) — Threadlinqs Intelligence
As of 2026-05-30, Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation (CVE-2021-22054) is a critical-severity vulnerability threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-0201 · Severity: CRITICAL · CVSS: 7.5 · Status: MONITORING · Category: VULNERABILITY
Attribution: N/A · UNKNOWN
A pre-authentication Server-Side Request Forgery (SSRF) vulnerability in Omnissa (formerly VMware) Workspace ONE UEM console is under active exploitation, prompting CISA KEV addition on March 9, 2026.
CVE-2021-22054 is a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability affecting Omnissa (formerly VMware) Workspace ONE UEM console, the enterprise Mobile Device Management (MDM) platform used by thousands of organizations worldwide.
The vulnerability exists in the BlobHandler.ashx endpoint present in two web applications within the UEM console: /AirWatch/BlobHandler.ashx and /Catalog/BlobHandler.ashx. The Catalog endpoint is particularly dangerous as it remains accessible even on hardened UEM deployments.
The root cause is a hardcoded static master encryption key used by the UEM database encryption subsystem. When the keyVersion parameter equals 'kv0' or is null, the DataEncryption.DecryptString() function defaults to this static master key with a known passphrase and salt value. An attacker can craft encrypted payloads using these known parameters, submit them via the Url query parameter to BlobHandler.ashx, and the server will decrypt and proxy the request through ProxyService.ProxyServerResponse() — effectively making arbitrary HTTP requests on behalf of the attacker.
The exploitation chain follows a specific sequence: (1) construct a target URL for the desired internal or external resource, (2) encrypt it using the hardcoded master key parameters with the native AirWatch encryption functions, (3) Base64-encode the encrypted payload with Unicode encoding, (4) submit via GET request to the vulnerable endpoint with the Url parameter. The server processes the request with full HTTP method support (GET, POST, PUT, DELETE) and allows custom request bodies, making this a full-featured SSRF primitive.
In cloud-hosted deployments (particularly AWS), this vulnerability enables attackers to access the EC2 Instance Metadata Service at 169.254.169.254 to harvest IAM role credentials, enumerate internal cloud infrastructure, and pivot to additional AWS services. For on-premise deployments, attackers gain the ability to scan internal networks, access internal services, and exfiltrate sensitive data from behind the firewall.
Originally disclosed in December 2021 under VMware advisory VMSA-2021-0029, the vulnerability gained renewed urgency in April 2022 when Assetnote researchers published detailed exploitation analysis including the encryption algorithm internals. CISA first urged patching in December 2021, and the addition to the Known Exploited Vulnerabilities catalog on March 9, 2026 with a remediation deadline of March 23, 2026 confirms that active exploitation campaigns are ongoing against unpatched instances.
The affected versions span four major release branches: 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37. Organizations running any of these versions must patch immediately or apply the web.config workaround to block access to BlobHandler.ashx endpoints.
---
**Revalidated on 2026-03-12**
UPDATE (2026-03-12 Revalidation): The exploitation landscape for CVE-2021-22054 has escalated significantly. GreyNoise documented a coordinated SSRF exploitation surge in March 2025 involving 400+ unique IPs targeting this vulnerability alongside other SSRF flaws (including CVE-2020-7796 and CVE-2024-21893) in what analysts describe as structured, automated pre-compromise intelligence gathering rather than opportunistic scanning. The geographic targeting spans the US, Germany, Singapore, India, Lithuania, Japan, and Israel. This coordinated activity likely contributed to CISA's decision to add CVE-2021-22054 to the KEV catalog on March 9, 2026 — over four years after initial disclosure — alongside SolarWinds WHD (CVE-2025-26399) and Ivanti EPM (CVE-2026-1603), with a federal remediation deadline of March 23, 2026. The batch addition pattern suggests intelligence indicating coordinated campaigns against enterprise management infrastructure. No specific APT or ransomware group attribution has been publicly assigned; CISA lists ransomware usage as
Target sectors: government, healthcare, financial, technology, education, telecommunications, defense, manufacturing, energy
Target regions: North America, Europe, Asia-Pacific, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2021-22054, T1190, T1595, T1590, T1018, T1046, T1580, T1552, T1212, T1213, T1210