Live › vulnerability › CVE-2021-21975
Go to dashboardVMware vRealize Operations Manager API before 8.4 has a server-side request forgery flaw that lets a remote attacker make the server send requests to internal systems. The sources say an attacker can use it to steal administrative credentials, and CISA lists it as actively exploited, with ransomware use noted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| VMware vRealize Operations Manager API | vendor | – | – |
Unknown from the sources. In the analyst’s queue.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2021-21975")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.