CVE-2021-21975
Published 2021-03-31 · Updated 2026-10-02 · Source security@vmware.com
Summary
CVE-2021-21975 is a high-severity (CVSS 7.5) vulnerability in VMware vRealize Operations Manager API. CISA added it to the Known Exploited Vulnerabilities catalog on January 18, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by February 1, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. VMware has 26 vulnerabilities in the KEV catalog, 9 of them linked to ransomware.
All 26 known-exploited VMware vulnerabilities →Description
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA Known-Exploited Vulnerability
Product: VMware — vRealize Operations Manager API
Name: VMware Server Side Request Forgery in vRealize Operations Manager API
Date added: 2022-01-18 · Due: 2022-02-01
Required action: Apply updates per vendor instructions.
References
- http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html
- https://www.vmware.com/security/advisories/VMSA-2021-0004.html
- http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html
- https://www.vmware.com/security/advisories/VMSA-2021-0004.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21975