VMware Workspace One UEM Console vulnerabilities

2 CVEs affecting VMware Workspace One UEM Console, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22054, published 2021-12-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-22054: Omnissa Workspace ONE Server-Side Request Forgery, published 2021-12-17. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2026-03-09. EPSS: 99.7% chance of exploitation in the next 30 days. VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a…
CVE-2021-22029, published 2021-08-31. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/system/admins/session could cause an API denial of service due to improper rate…