CVEvulnerability

CVE-2021-21972

9.8 CRITICAL Known exploited Published 2021-02-24 Modified 2026-08-12 Official page ↗

CISA Known Exploited Vulnerability

VMware vCenter Server Remote Code Execution Vulnerability — VMware vCenter Server

VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.

Added to KEV
2021-11-03
Remediation due
2021-11-17
Ransomware use
Known
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2021-21972
Status
Analyzed
Published
2021-02-24
Last modified
2026-08-12
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-22

Description

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Affected configurations

• vmware cloud foundation (>= 3.0 < 3.10.1.2) • vmware cloud foundation (>= 4.0 < 4.2) • vmware vcenter server 6.5 • vmware vcenter server 6.7 • vmware vcenter server 7.0

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

Referenced by CWE · observed example (5)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-23 Relative Path Traversal weakness
  • CWE-284 Improper Access Control weakness
  • CWE-287 Improper Authentication weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References