$ cve CVE-2021-21972 JSON

CVE-2021-21972 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 99.9% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2021-11-17.

Description

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	99.87% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-22
On CISA KEV	yes — remediate by 2021-11-17
Public exploit	yes
Published	2021-02-24
Last modified	2026-08-12

CISA KEV

Name	VMware vCenter Server Remote Code Execution Vulnerability
Added	2021-11-03
Due	2021-11-17
Vendor / product	VMware / vCenter Server
Ransomware use	known

Affected (2)

Vendor	Product
vmware	cloud foundation
vmware	vcenter server

Public exploits

Source	Title	Date
exploit-db	VMware vCenter Server 7.0 - Remote Code Execution (RCE) (Unauthenticated)	2021-06-24
exploit-db	VMware vCenter Server 7.0 - Unauthenticated File Upload	2021-03-01

References

→ the Explorer · watch your stack · NVD