HackerFeeds
All CVEs

CVE-2021-21985

CRITICAL9.8
CISA KEV

Published 2021-05-26 · Updated 2026-08-12 · Source security@vmware.com

Summary

CVE-2021-21985 is a critical-severity (CVSS 9.8) vulnerability in VMware vCenter Server. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by November 17, 2021. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. VMware has 26 vulnerabilities in the KEV catalog, 9 of them linked to ransomware.

All 26 known-exploited VMware vulnerabilities →

Description

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-918CWE-20CWE-470CWE-918

CISA Known-Exploited Vulnerability

Product: VMware — vCenter Server

Name: VMware vCenter Server Improper Input Validation Vulnerability

Date added: 2021-11-03 · Due: 2021-11-17

USED IN RANSOMWARE

Required action: Apply updates per vendor instructions.

References

View on NVD