{"id":"CVE-2021-21972","kind":"vulnerability","aliases":["CVE-2021-21972"],"related":[],"title":"VMware vCenter Server: VMware vCenter Server Remote Code Execution Vulnerability","description":"The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).","summary":"VMware vCenter Server's vSphere Client (HTML5) has a remote code execution flaw in a vCenter Server plugin, reachable over the network on port 443 with no authentication stated in the sources. An attacker who can reach the port can run commands with unrestricted privileges on the operating system hosting vCenter Server, and this CVE is listed as exploited in the wild.","severity":"critical","cvss":10.0,"epss":0.99865,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"VMware vCenter Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","on-prem","ransomware","self-hosted","vcenter","vmware","vsphere"],"not_affected_if":["managed-hosting","vcenter-already-patched"],"how_to_check":"Check the installed vCenter version (Summary page in vSphere Client or the VAMI at https:443 /login) and compare against the fixed builds: 7.0 U1c, 6.7 U3l, 6.5 U3n.\nFor VMware Cloud Foundation, check versions 4.2 and 3.10.1.2 or later.\nReview whether port 443 on vCenter is reachable from untrusted networks.","fix":"Upgrade vCenter Server to 7.0 U1c, 6.7 U3l, or 6.5 U3n, or to the matching VMware Cloud Foundation release; the sources do not give a workaround.\nIf patching cannot happen immediately, restrict port 443 access to vCenter to management networks only.","status":"open","published_at":"2021-02-24T17:15:15+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:26+00:00","updated_at":"2026-10-23T20:29:26+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-23T20:29:26Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade vCenter Server to 7.0 U1c, 6.7 U3l, or 6.5 U3n, or to the matching VMware Cloud Foundation release; the sources do not give a workaround.\nIf patching cannot happen immediately, restrict port 443 access to vCenter to management networks only.","summary":"VMware vCenter Server's vSphere Client (HTML5) has a remote code execution flaw in a vCenter Server plugin, reachable over the network on port 443 with no authentication stated in the sources. An attacker who can reach the port can run commands with unrestricted privileges on the operating system hosting vCenter Server, and this CVE is listed as exploited in the wild.","category":"infrastructure","who_cares":["vcenter","vmware","vsphere","on-prem","self-hosted"],"confidence":0.9,"analyst_note":"Exploited in the wild per CISA KEV and ransomware-linked; confirm whether a vendor advisory (VMSA-2021-0010) lists exact fixed builds and any IOC or compromise-check guidance beyond the sources given.","how_to_check":"Check the installed vCenter version (Summary page in vSphere Client or the VAMI at https:443 /login) and compare against the fixed builds: 7.0 U1c, 6.7 U3l, 6.5 U3n.\nFor VMware Cloud Foundation, check versions 4.2 and 3.10.1.2 or later.\nReview whether port 443 on vCenter is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["managed-hosting","vcenter-already-patched"],"severity_if_unknown":"critical"},"cost_usd":0.000512,"input_tokens":2250,"output_tokens":573,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2021':12A,15A '-21972':13A,16A '3':165C '3.10.1.2':168C '4':160C '4.2':163C '443':56B,117C '6.5':152C,154C '6.7':147C,149C '7':142C '7.0':145C 'access':114C 'actor':111C 'affect':138C 'attack':65B 'authent':59B 'client':37B,96C 'cloud':158C 'code':8A,42B,101C 'command':73B,124C 'contain':98C 'cve':11A,14A,86B 'execut':9A,43B,102C,123C 'exploit':20B,90B,119C 'flaw':44B 'foundat':159C 'host':28B,81B,134C 'html5':38B,97C 'infrastructur':21B 'issu':121C 'list':88B 'malici':110C 'may':118C 'network':53B,113C 'on-prem':22B 'oper':79B,131C 'plugin':49B,108C 'port':55B,70B,116C 'prem':24B 'privileg':76B,127C 'ransomwar':25B 'reach':68B 'reachabl':50B 'remot':7A,41B,100C 'run':72B 'self':27B 'self-host':26B 'server':3A,6A,19A,34B,48B,83B,107C,136C,141C 'sourc':63B 'state':60B 'system':80B,132C 'u1c':146C 'u3l':150C 'u3n':155C 'under':130C 'unrestrict':75B,126C 'vcenter':2A,5A,18A,29B,33B,47B,82B,106C,135C,140C 'vmware':1A,4A,17A,30B,32B,139C,157C 'vsphere':31B,36B,95C 'vulner':10A,103C 'wild':93B 'x':143C,161C,166C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-02-24T17:15:15+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-21972","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21972","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T20:35:39+00:00","note":null},{"source":"epss","external_id":"CVE-2021-21972","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21972","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-21972","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21972","severity":null,"published_at":"2021-02-24T17:15:15+00:00","modified_at":"2026-08-12T05:17:35+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}