Critical SSRF in Omnissa Workspace ONE UEM (CVE‑2021‑22054) Enables Unauthenticated Data Access
What It Is – A server‑side request forgery (SSRF) flaw in Omnissa Workspace ONE UEM (formerly VMware Workspace ONE UEM) that lets an actor with network reach send arbitrary HTTP requests through the UEM server without authentication, potentially harvesting internal configuration data or credentials.
Exploitability – The vulnerability is publicly disclosed in the CISA Known Exploited Vulnerabilities (KEV) catalog; proof‑of‑concept code exists and active exploitation has been reported. CVSS v3.1 base score 8.8 (High).
Affected Products – All unpatched versions of Omnissa Workspace ONE UEM prior to the vendor‑released fix (see Omnissa advisory).
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous verification of network‑segmentation and access‑control controls that prevent internal services from being reachable without proper authorization.
- Demonstrates how a single technical flaw can break multiple control objectives (e.g., “restrict unauthorized network access” and “protect sensitive data”) across frameworks, underscoring the value of a unified control‑mapping approach.
- Provides a concrete evidence point for auditors: remediation of the SSRF, updated segmentation policies, and documented control‑evidence collection show due diligence and a defensible audit trail.
Recommended Actions
- Apply Omnissa’s patch for CVE‑2021‑22054 immediately.
- Verify the running version of Workspace ONE UEM across all environments.
- Enforce strict network segmentation so the UEM server cannot reach internal services that are not required for its function.
- Incorporate SSRF testing into regular vulnerability‑scanning and penetration‑testing cycles.
- Update your control‑mapping repository and evidence store to reflect the remediation and segmentation controls.
Source: CISA KEV – CVE‑2021‑22054