CVE-2021-21972

CRITICAL9.8

CISA KEV

Published 2021-02-24 · Updated 2026-08-12 · Source security@vmware.com

Description

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-22CWE-22

CISA Known-Exploited Vulnerability

Product: VMware — vCenter Server

Name: VMware vCenter Server Remote Code Execution Vulnerability

Date added: 2021-11-03 · Due: 2021-11-17

USED IN RANSOMWARE

Required action: Apply updates per vendor instructions.

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-96257
A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
2026-09-23 · score 10.0
CVE-2026-18169
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.
2026-09-22 · score 9.9
CVE-2026-18163
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.
2026-09-22 · score 9.8
CVE-2026-18162
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.
2026-09-22 · score 9.8
CVE-2026-17645
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to gain elevated privileges due to improper privilege management.
2026-09-22 · score 9.1