Loading story…
VMware Workspace ONE UEM (formerly AirWatch) is affected by CVE-2021-22054, a critical pre-authentication server-side request forgery flaw (CVSS 9.1) in the BlobHandler.ashx endpoint used by the AirWatch Console and Catalog applications. Attackers can exploit hardcoded encryption parameters—by selecting key version kv0—to create valid encrypted URL parameters that cause a vulnerable UEM server to send arbitrary HTTP requests, including attacker-controlled methods and bodies, to internal or external targets.
The publicly exposed /Catalog/BlobHandler.ashx endpoint may be reachable even where the administrative console is restricted, enabling access to internal services or cloud metadata endpoints; on AWS-hosted deployments, this could expose IAM-role credentials. VMware issued fixes in VMSA-2021-0029 in December 2021 and later warned that public technical details increased exploitation risk. Organizations that have not patched should apply the vendor updates or mitigations and rotate the static master key according to KB88323.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Assetnote disclosed technical details of CVE-2021-22054, including the hardcoded default "kv0" master key that allowed unauthenticated attackers to encrypt arbitrary SSRF targets. The researchers demonstrated access to AWS instance metadata through vulnerable Workspace ONE UEM deployments and stated that both SaaS and on-premises deployments were exploitable.
VMware published a blog post urging customers to apply the December 2021 fixes or workarounds after public vulnerability details became available. It also provided KB88323 instructions for rotating the static master key associated with the issue.
VMware released patches for CVE-2021-22054 through advisory VMSA-2021-0029, including fixed Workspace ONE UEM releases for affected versions. The patches and documented workarounds prevented exploitation of the SSRF issue.
VMware confirmed that it was developing a patch for the reported Workspace ONE UEM SSRF vulnerability.
Assetnote researchers reported the pre-authentication SSRF vulnerability later designated CVE-2021-22054 to VMware. The flaw affected BlobHandler.ashx endpoints in Workspace ONE UEM.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
slcyber.io
Open sourceslcyber.io
Open sourceblog.assetnote.io
Open sourceblogs.vmware.com
Open sourcevmware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers sharply increased exploitation attempts against **CVE-2022-22954**, a critical remote code execution flaw affecting **VMware Workspace ONE Access**, **VMware Identity Manager**, and related products covered by VMware advisory **`VMSA-2022-0011`**. The vulnerability, rated **CVSS 9.8**, was disclosed by VMware as part of updates addressing multiple flaws, and security monitoring showed probing beginning shortly after disclosure before spiking significantly later as attackers intensified scanning and exploitation activity. Observed payloads attempted to execute shell commands that would fetch and run malicious binaries using tools such as `wget` and `curl`, indicating efforts to gain remote control of exposed systems after successful compromise. Monitoring data cited major apparent source locations including **Lithuania** and the **United States**, and defenders were urged to apply VMware’s published patches or mitigations immediately to reduce exposure to active internet exploitation.
Aug 15, 2026
Attackers actively exploited **VMware Workspace ONE Access**, **Identity Manager**, and **vRealize Automation** flaws in the wild, with **`CVE-2022-22954`** emerging as the primary initial access vector. Palo Alto Networks Unit 42 said exploitation began shortly after VMware disclosed the issue, describing the bug as a trivial server-side template injection that can be triggered with a single HTTP request for remote code execution. The activity prompted a **CISA alert**, and researchers warned that related VMware flaws **`CVE-2022-22972`** and **`CVE-2022-22973`** were also highly likely to be targeted. Observed post-exploitation activity included deployment of **Mirai** and **Gafgyt** variants, **Enemybot**, webshells, Perl-based shellbots, coinminers, and payloads that modified SSH keys for persistence. Unit 42 reported that attackers could chain **`CVE-2022-22960`** after the initial compromise to escalate privileges to root by abusing writable paths and sudo-accessible scripts. The company said its Threat Prevention signature **`92483`** blocks exploitation attempts and noted that **about 800 internet-exposed Workspace ONE Access instances** were visible, underscoring the exposure risk for unpatched organizations.
Jun 29, 2026
VMware's `VMSA-2021-0020` security advisory addresses multiple vulnerabilities in vCenter Server and Cloud Foundation, including **CVE-2021-22005**, a critical remotely exploitable file-upload flaw rated CVSS 9.8. An attacker with network access to vCenter can exploit the issue regardless of vCenter configuration and execute commands or deploy software on the vCenter Server Appliance; public working exploits became available shortly after disclosure. Organizations should apply VMware's updates immediately and treat exposed or unpatched vCenter infrastructure as potentially compromised. Patching removes the vulnerable condition but does not reveal prior exploitation, so incident-response teams should conduct compromise assessments and threat hunting, while retaining sufficient forensic telemetry to investigate potential ransomware activity or other follow-on intrusion.
Sep 22, 2026