# Omnissa Workspace ONE UEM Pre-Auth SSRF Active Exploitation (CVE-2021-22054)

> A pre-authentication Server-Side Request Forgery (SSRF) vulnerability in Omnissa (formerly VMware) Workspace ONE UEM console is under active exploitation, prompting CISA KEV addition on March 9, 2026. The flaw in BlobHandler.ashx endpoints allows unauthenticated attackers to forge arbitrary server-side HTTP requests by exploiting a hardcoded static master encryption key, enabling internal network reconnaissance, cloud metadata credential harvesting, and sensitive data exfiltration.

- **Published:** 2026-03-09T12:00:00Z
- **Last reviewed:** 2026-03-09T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0201
- **ID:** TL-2026-0201
- **Severity:** CRITICAL (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-22054

## Description

CVE-2021-22054 is a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability affecting Omnissa (formerly VMware) Workspace ONE UEM console, the enterprise Mobile Device Management (MDM) platform used by thousands of organizations worldwide.

The vulnerability exists in the BlobHandler.ashx endpoint present in two web applications within the UEM console: /AirWatch/BlobHandler.ashx and /Catalog/BlobHandler.ashx. The Catalog endpoint is particularly dangerous as it remains accessible even on hardened UEM deployments.

The root cause is a hardcoded static master encryption key used by the UEM database encryption subsystem. When the keyVersion parameter equals 'kv0' or is null, the DataEncryption.DecryptString() function defaults to this static master key with a known passphrase and salt value. An attacker can craft encrypted payloads using these known parameters, submit them via the Url query parameter to BlobHandler.ashx, and the server will decrypt and proxy the request through ProxyService.ProxyServerResponse() — effectively making arbitrary HTTP requests on behalf of the attacker.

The exploitation chain follows a specific sequence: (1) construct a target URL for the desired internal or external resource, (2) encrypt it using the hardcoded master key parameters with the native AirWatch encryption functions, (3) Base64-encode the encrypted payload with Unicode encoding, (4) submit via GET request to the vulnerable endpoint with the Url parameter. The server processes the request with full HTTP method support (GET, POST, PUT, DELETE) and allows custom request bodies, making this a full-featured SSRF primitive.

In cloud-hosted deployments (particularly AWS), this vulnerability enables attackers to access the EC2 Instance Metadata Service at 169.254.169.254 to harvest IAM role credentials, enumerate internal cloud infrastructure, and pivot to additional AWS services. For on-premise deployments, attackers gain the ability to scan internal networks, access internal services, and exfiltrate sensitive data from behind the firewall.

Originally disclosed in December 2021 under VMware advisory VMSA-2021-0029, the vulnerability gained renewed urgency in April 2022 when Assetnote researchers published detailed exploitation analysis including the encryption algorithm internals. CISA first urged patching in December 2021, and the addition to the Known Exploited Vulnerabilities catalog on March 9, 2026 with a remediation deadline of March 23, 2026 confirms that active exploitation campaigns are ongoing against unpatched instances.

The affected versions span four major release branches: 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37. Organizations running any of these versions must patch immediately or apply the web.config workaround to block access to BlobHandler.ashx endpoints.

---

**Revalidated on 2026-03-12**

UPDATE (2026-03-12 Revalidation): The exploitation landscape for CVE-2021-22054 has escalated significantly. GreyNoise documented a coordinated SSRF exploitation surge in March 2025 involving 400+ unique IPs targeting this vulnerability alongside other SSRF flaws (including CVE-2020-7796 and CVE-2024-21893) in what analysts describe as structured, automated pre-compromise intelligence gathering rather than opportunistic scanning. The geographic targeting spans the US, Germany, Singapore, India, Lithuania, Japan, and Israel. This coordinated activity likely contributed to CISA's decision to add CVE-2021-22054 to the KEV catalog on March 9, 2026 — over four years after initial disclosure — alongside SolarWinds WHD (CVE-2025-26399) and Ivanti EPM (CVE-2026-1603), with a federal remediation deadline of March 23, 2026. The batch addition pattern suggests intelligence indicating coordinated campaigns against enterprise management infrastructure. No specific APT or ransomware group attribution has been publicly assigned; CISA lists ransomware usage as 'Unknown'. Organizations running Workspace ONE UEM on-premise should note that Omnissa's September 2025 Vulnerability Defense product (integrating CrowdStrike Falcon) does not retroactively mitigate unpatched CVE-2021-22054 instances — patches from VMSA-2021-0029 (versions 20.0.8.37, 20.11.0.40, 21.2.0.27, 21.5.0.37+) or the web.config workaround from KB87167 remain the only remediation paths.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1552 Unsecured Credentials
- T1212 Exploitation for Credential Access
- T1213 Data from Information Repositories
- T1210 Exploitation of Remote Services
- T1211 Exploitation for Stealth
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1588 Obtain Capabilities

## Sources

- [CISA KEV Catalog — CVE-2021-22054 Added March 9, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [VMware Security Advisory VMSA-2021-0029](https://www.vmware.com/security/advisories/VMSA-2021-0029.html)
- [NVD — CVE-2021-22054](https://nvd.nist.gov/vuln/detail/CVE-2021-22054)
- [Assetnote — Encrypting Our Way to SSRF in VMware Workspace One UEM](https://www.assetnote.io/resources/research/encrypting-our-way-to-ssrf-in-vmware-workspace-one-uem-cve-2021-22054)
- [Assetnote Advisory — VMware Workspace One UEM SSRF](https://www.assetnote.io/resources/research/advisory-vmware-workspace-one-uem-ssrf-cve-2021-22054)
- [VMware Security Blog — Workspace ONE UEM SSRF Patch Alert](https://blogs.vmware.com/security/2022/04/workspace-one-uem-ssrf-cve-2021-22054-patch-alert.html)
- [BleepingComputer — CISA Urges VMware Admins to Patch Critical Workspace ONE UEM Flaw](https://www.bleepingcomputer.com/news/security/cisa-urges-vmware-admins-to-patch-critical-flaw-in-workspace-one-uem/)
- [GBHackers — Critical SSRF Bug in VMware Workspace ONE UEM Console](https://gbhackers.com/critical-ssrf-bug-in-vmware-workspace-one-uem-console/)
- [Tenable Plugin 156361 — VMware Workspace ONE UEM Console SSRF](https://www.tenable.com/plugins/nessus/156361)
- [CISA Alert — VMware Releases Security Advisory (December 2021)](https://www.cisa.gov/news-events/alerts/2021/12/17/vmware-releases-security-advisory)
- [NHS England Digital — VMware Releases Security Update for Workspace ONE UEM Console](https://digital.nhs.uk/cyber-alerts/2021/cc-4001)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0201