---
id: "CVE-2021-21972"
kind: "vulnerability"
aliases: ["CVE-2021-21972"]
title: "VMware vCenter Server: VMware vCenter Server Remote Code Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.99865
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "VMware vCenter Server", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "on-prem", "ransomware", "self-hosted", "vcenter", "vmware", "vsphere"]
not_affected_if: ["managed-hosting", "vcenter-already-patched"]
published_at: "2021-02-24T17:15:15+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:29:26+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21972", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-21972", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21972", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# VMware vCenter Server: VMware vCenter Server Remote Code Execution Vulnerability

VMware vCenter Server's vSphere Client (HTML5) has a remote code execution flaw in a vCenter Server plugin, reachable over the network on port 443 with no authentication stated in the sources. An attacker who can reach the port can run commands with unrestricted privileges on the operating system hosting vCenter Server, and this CVE is listed as exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VMware vCenter Server affected ? fixed ?

## How to check

Check the installed vCenter version (Summary page in vSphere Client or the VAMI at https:443 /login) and compare against the fixed builds: 7.0 U1c, 6.7 U3l, 6.5 U3n.
For VMware Cloud Foundation, check versions 4.2 and 3.10.1.2 or later.
Review whether port 443 on vCenter is reachable from untrusted networks.

## Fix

Upgrade vCenter Server to 7.0 U1c, 6.7 U3l, or 6.5 U3n, or to the matching VMware Cloud Foundation release; the sources do not give a workaround.
If patching cannot happen immediately, restrict port 443 access to vCenter to management networks only.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21972
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-21972
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-21972

## From the sources

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_