CVE-2021-21985: VMware vCenter Server Improper Input Validation Vulnerability
Vulnerability summary
CVE-2021-21985 is a high (CVSS 10.0) Server-Side Request Forgery (SSRF) vulnerability in VMware vCenter Server. It is known to be exploited: CISA lists it, first on 03-11-2021. It has been used in ransomware campaigns. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 26-05-2021PublishedVulnerability first disclosed.
- 03-11-2021Added to CISA KEVVMware vCenter Server Improper Input Validation Vulnerability
- 17-11-2021CISA remediation dueApply updates per vendor instructions.
- 12-08-2026Last modifiedVulnerability information updated.
Description
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
100.00%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 100.00% on 18-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-11-2021
- Federal due date
- 17-11-2021
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2021-21985
Public exploits
2 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
VMware vCenter Server Virtual SAN Health Check Plugin RCE
exploit/linux/http/vmware_vcenter_vsan_health_rce
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
Affected systems
Vmware2 products
- cloud_foundation≥ 3.0, < 3.10.2.1 | ≥ 4.0, < 4.2.1
- vcenter_serverEOL6.5 | 6.5:a | 6.5:b | 6.5:c | 6.5:d | 6.5:e | 6.5:f | 6.5:update1 | 6.5:update1b | 6.5:update1c | 6.5:update1d | 6.5:update1e | 6.5:update1g | 6.5:update2 | 6.5:update2b | 6.5:update2c | 6.5:update2d | 6.5:update2g | 6.5:update3 | 6.5:update3d | 6.5:update3f | 6.5:update3k | 6.5:update3n | 6.7 | 6.7:a | 6.7:b | 6.7:d | 6.7:update1 | 6.7:update1b | 6.7:update2 | 6.7:update2a | 6.7:update2c | 6.7:update3 | 6.7:update3a | 6.7:update3b | 6.7:update3f | 6.7:update3g | 6.7:update3j | 6.7:update3l | 6.7:update3m | 7.0 | 7.0:a | 7.0:b | 7.0:c | 7.0:d | 7.0:update1 | 7.0:update1a | 7.0:update1c | 7.0:update1d | 7.0:update2 | 7.0:update2a
1 vendor · 2 products
References
4 links- packetstormsecurity.com/files/162812/VMware-Security-Advisory-2021-0010.htmlX Refsource MISCThird Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21985Government ResourceUS Government Resource