CVE-2021-22054

CVE-2021-22054 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 9, 2026. EIP tracks 1 public exploit from researchers including MKSx. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-22054, an SSRF vulnerability in VMware Workspace ONE UEM. The script generates encrypted SSRF payloads and can send requests to exploit the vulnerability, leveraging AES encryption and specific API endpoints.

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information.