Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation (CVE-2021-22054)

Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation (TL-2026-0201), also tracked as VMSA-2021-0029, is a critical-severity software vulnerability scored CVSS 7.5, first published 2026-03-09. It has no confirmed attribution, affects Omnissa (formerly VMware/Broadcom) Workspace ONE UEM Console, references 1 CVE (CVE-2021-22054), maps to 14 MITRE ATT&CK techniques (T1018, T1046, T1071), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-0201

Threat ID
TL-2026-0201
Also known as
VMSA-2021-0029
Severity
CRITICAL
CVSS
7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Status
MONITORING
Category
VULNERABILITY
First published
2026-03-09
Last reviewed
2026-03-09
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, healthcare, financial, technology, education, telecommunications, defense, manufacturing, energy
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
15

A pre-authentication Server-Side Request Forgery (SSRF) vulnerability in Omnissa (formerly VMware) Workspace ONE UEM console is under active exploitation, prompting CISA KEV addition on March 9, 2026. The flaw in BlobHandler.ashx endpoints allows unauthenticated attackers to forge arbitrary server-side HTTP requests by exploiting a hardcoded static master encryption key, enabling internal network reconnaissance, cloud metadata credential harvesting, and sensitive data exfiltration.

How Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation works

CVE-2021-22054 is a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability affecting Omnissa (formerly VMware) Workspace ONE UEM console, the enterprise Mobile Device Management (MDM) platform used by thousands of organizations worldwide.

The vulnerability exists in the BlobHandler.ashx endpoint present in two web applications within the UEM console: /AirWatch/BlobHandler.ashx and /Catalog/BlobHandler.ashx. The Catalog endpoint is particularly dangerous as it remains accessible even on hardened UEM deployments.

The root cause is a hardcoded static master encryption key used by the UEM database encryption subsystem. When the keyVersion parameter equals 'kv0' or is null, the DataEncryption.DecryptString() function defaults to this static master key with a known passphrase and salt value. An attacker can craft encrypted payloads using these known parameters, submit them via the Url query parameter to BlobHandler.ashx, and the server will decrypt and proxy the request through ProxyService.ProxyServerResponse() — effectively making arbitrary HTTP requests on behalf of the attacker.

The exploitation chain follows a specific sequence: (1) construct a target URL for the desired internal or external resource, (2) encrypt it using the hardcoded master key parameters with the native AirWatch encryption functions, (3) Base64-encode the encrypted payload with Unicode encoding, (4) submit via GET request to the vulnerable endpoint with the Url parameter. The server processes the request with full HTTP method support (GET, POST, PUT, DELETE) and allows custom request bodies, making this a full-featured SSRF primitive.

In cloud-hosted deployments (particularly AWS), this vulnerability enables attackers to access the EC2 Instance Metadata Service at 169.254.169.254 to harvest IAM role credentials, enumerate internal cloud infrastructure, and pivot to additional AWS services. For on-premise deployments, attackers gain the ability to scan internal networks, access internal services, and exfiltrate sensitive data from behind the firewall.

Originally disclosed in December 2021 under VMware advisory VMSA-2021-0029, the vulnerability gained renewed urgency in April 2022 when Assetnote researchers published detailed exploitation analysis including the encryption algorithm internals. CISA first urged patching in December 2021, and the addition to the Known Exploited Vulnerabilities catalog on March 9, 2026 with a remediation deadline of March 23, 2026 confirms that active exploitation campaigns are ongoing against unpatched instances.

The affected versions span four major release branches: 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37. Organizations running any of these versions must patch immediately or apply the web.config workaround to block access to BlobHandler.ashx endpoints.

---

**Revalidated on 2026-03-12**

UPDATE (2026-03-12 Revalidation): The exploitation landscape for CVE-2021-22054 has escalated significantly. GreyNoise documented a coordinated SSRF exploitation surge in March 2025 involving 400+ unique IPs targeting this vulnerability alongside other SSRF flaws (including CVE-2020-7796 and CVE-2024-21893) in what analysts describe as structured, automated pre-compromise intelligence gathering rather than opportunistic scanning. The geographic targeting spans the US, Germany, Singapore, India, Lithuania, Japan, and Israel. This coordinated activity likely contributed to CISA's decision to add CVE-2021-22054 to the KEV catalog on March 9, 2026 — over four years after initial disclosure — alongside SolarWinds WHD (CVE-2025-26399) and Ivanti EPM (CVE-2026-1603), with a federal remediation deadline of March 23, 2026. The batch addition pattern suggests intelligence indicating coordinated campaigns against enterprise management infrastructure. No specific APT or ransomware group attribution has been publicly assigned; CISA lists ransomware usage as 'Unknown'. Organizations running Workspace ONE UEM on-premise should note that Omnissa's September 2025 Vulnerability Defense product (integrating CrowdStrike Falcon) does not retroactively mitigate unpatched CVE-2021-22054 instances — patches from VMSA-2021-0029 (versions 20.0.8.37, 20.11.0.40, 21.2.0.27, 21.5.0.37+) or the web.config workaround from KB87167 remain the only remediation paths.

MITRE ATT&CK techniques used in TL-2026-0201

discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1580 Cloud Infrastructure Discovery

command-and-control

T1071 Application Layer Protocol

initial-access

T1190 Exploit Public-Facing Application

lateral-movement

T1210 Exploitation of Remote Services

defense-evasion

T1211 Exploitation for Stealth

credential-access

T1212 Exploitation for Credential Access; T1552 Unsecured Credentials

collection

T1213 Data from Information Repositories

exfiltration

T1567 Exfiltration Over Web Service

resource-development

T1588 Obtain Capabilities

reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

Affected products and versions in Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation

  • Omnissa (formerly VMware/Broadcom) — Workspace ONE UEM Console
    Vulnerable versions: 20.0.8.0 - 20.0.8.36; 20.11.0.0 - 20.11.0.39; 21.2.0.0 - 21.2.0.26; 21.5.0.0 - 21.5.0.36
    Fixed in: 20.0.8.37; 20.11.0.40; 21.2.0.27; 21.5.0.37

Remediation for Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation

Patches

  • Workspace ONE UEM 20.0.8.37 (fixes 20.0.8.x branch)
  • Workspace ONE UEM 20.11.0.40 (fixes 20.11.0.x branch)
  • Workspace ONE UEM 21.2.0.27 (fixes 21.2.0.x branch)
  • Workspace ONE UEM 21.5.0.37 (fixes 21.5.0.x branch)

Immediate actions

  • Apply VMware/Omnissa patches for Workspace ONE UEM to versions 20.0.8.37, 20.11.0.40, 21.2.0.27, or 21.5.0.37 or later
  • Block access to /AirWatch/BlobHandler.ashx and /Catalog/BlobHandler.ashx endpoints at the web application firewall or reverse proxy
  • Edit UEM web.config to disable BlobHandler.ashx endpoint with Url parameter as documented in VMSA-2021-0029 workaround
  • Monitor web server logs for requests to BlobHandler.ashx with encoded Url parameters
  • Enforce IMDSv2 on all AWS EC2 instances running Workspace ONE UEM to prevent metadata credential theft

Workarounds

  • Block BlobHandler.ashx requests containing Url parameter at reverse proxy or WAF
  • Modify web.config to remove or restrict BlobHandler.ashx handler mapping
  • Restrict network access to UEM console to trusted management subnets only

Longer-term hardening

  • Rotate the static master encryption key per VMware KB88323 instructions
  • Upgrade to the latest supported Omnissa Workspace ONE UEM release
  • Implement network segmentation to restrict UEM console access to authorized management networks only
  • Deploy Web Application Firewall rules to detect and block SSRF patterns against UEM endpoints
  • Conduct audit of cloud IAM roles attached to UEM instances and enforce least-privilege policies
  • Enable comprehensive logging and monitoring for all UEM console web traffic

CVEs associated with Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation

CVE-2021-22054

Weaknesses (CWE) in Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation

CWE-918

Timeline of Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation

  • VMware publishes security advisory VMSA-2021-0029 disclosing CVE-2021-22054 SSRF in Workspace ONE UEM console with patches available
  • NVD publishes CVE-2021-22054 with CVSS v3.1 base score of 7.5 (HIGH) and CWE-918 classification
  • CISA issues alert urging VMware administrators to immediately patch the critical SSRF vulnerability in Workspace ONE UEM
  • VMware Security Blog re-issues urgent patch alert warning that published exploitation details make real-world attacks more likely
  • Assetnote researchers (Shubham Shah, James Hebden) publish detailed technical analysis including encryption algorithm internals, hardcoded master key, and exploitation methodology
  • Broadcom completes acquisition of VMware; Workspace ONE product line eventually transitions to Omnissa subsidiary
  • GreyNoise observes coordinated SSRF exploitation surge — 400+ IPs simultaneously targeting CVE-2021-22054 and related SSRF vulnerabilities across US, Germany, Singapore, India, Lithuania, Japan, and Israel, indicating structured automation and pre-compromise intelligence gathering
  • Omnissa announces Workspace ONE Vulnerability Defense combining UEM with CrowdStrike Falcon Exposure Management for proactive endpoint vulnerability remediation — does not retroactively patch CVE-2021-22054
  • CISA adds CVE-2021-22054, CVE-2025-26399 (SolarWinds WHD), and CVE-2026-1603 (Ivanti EPM) to KEV catalog in single batch, federal remediation deadline set for March 23, 2026
  • NVD entry for CVE-2021-22054 last modified reflecting CISA KEV addition and updated exploitation status
  • CISA adds CVE-2021-22054 to the Known Exploited Vulnerabilities catalog confirming active exploitation in the wild, with remediation deadline of March 23, 2026
  • Multiple security outlets (The Hacker News, SecurityAffairs, BackBox, MalwareTips) publish coverage of the CISA KEV addition, amplifying urgency for enterprise Workspace ONE UEM administrators
  • As of 2026-05-29, CVE-2021-22054 (Omnissa Workspace ONE UEM pre-auth SSRF) remains actively exploited per its still-current CISA KEV listing (added 2026-03-09, deadline 2026-03-23 now passed) and GreyNoise's coordinated SSRF surge. Vendor patches exist since 2021 and no successor/actor disruption is reported, so it stays a tracked, patch-available threat against unpatched instances.

Sources cited for Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation

Threats related to Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation

Detection coverage for TL-2026-0201

As of 2026-03-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0201 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats