CVE-2021-22005
Published 2021-09-23 · Updated 2026-06-17 · Source security@vmware.com
Summary
CVE-2021-22005 is a critical-severity (CVSS 9.8) vulnerability in VMware vCenter Server. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by November 17, 2021. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. VMware has 26 vulnerabilities in the KEV catalog, 9 of them linked to ransomware.
All 26 known-exploited VMware vulnerabilities →Description
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: VMware — vCenter Server
Name: VMware vCenter Server File Upload Vulnerability
Date added: 2021-11-03 · Due: 2021-11-17
Required action: Apply updates per vendor instructions.
References
- http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.html
- https://www.vmware.com/security/advisories/VMSA-2021-0020.html
- http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.html
- https://www.vmware.com/security/advisories/VMSA-2021-0020.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22005