{"id":"CVE-2021-21975","kind":"vulnerability","aliases":["CVE-2021-21975"],"related":[],"title":"VMware vRealize Operations Manager API: VMware Server Side Request Forgery in vRealize Operations Manager API","description":"Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.\n\nCISA required action: Apply updates per vendor instructions.","summary":"VMware vRealize Operations Manager API before 8.4 has a server-side request forgery flaw that lets a remote attacker make the server send requests to internal systems. The sources say an attacker can use it to steal administrative credentials, and CISA lists it as actively exploited, with ransomware use noted.","severity":"critical","cvss":9.8,"epss":0.78001,"exploited":true,"exploited_at":"2022-01-18T00:00:00+00:00","products":[{"name":"VMware vRealize Operations Manager API","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ransomware","self-hosted","vendor","vmware","vrealize-operations"],"not_affected_if":["default-config"],"how_to_check":null,"fix":"Upgrade VMware vRealize Operations Manager to 8.4 or later, following VMware's advisory. Rotate administrative credentials on the appliance after patching if it was exposed.","status":"open","published_at":"2021-03-31T18:15:14+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:31:37+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:31:37Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade VMware vRealize Operations Manager to 8.4 or later, following VMware's advisory. Rotate administrative credentials on the appliance after patching if it was exposed.","reach":"network","impact":"high","summary":"VMware vRealize Operations Manager API before 8.4 has a server-side request forgery flaw that lets a remote attacker make the server send requests to internal systems. The sources say an attacker can use it to steal administrative credentials, and CISA lists it as actively exploited, with ransomware use noted.","category":"vendor","who_cares":["vmware","vrealize-operations","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker steals administrative credentials via forged internal requests","analyst_note":"Find the VMware advisory for CVE-2021-21975 and confirm the exact fixed build and any detection steps; the sources do not name them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000479,"input_tokens":2879,"output_tokens":382,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the VMware advisory for CVE-2021-21975 and confirm the exact fixed build and any detection steps; the sources do not name them.","search":"'-2021':17A,20A '-21975':18A,21A '8.4':43B,100C 'access':108C 'action':126C 'activ':82B 'actor':105C 'administr':75B,122C 'allow':102C 'api':5A,15A,26A,41B,97C,114C 'appli':127C 'attack':56B,69B,119C 'cisa':78B,124C 'credenti':76B,123C 'cve':16A,19A 'exploit':27B,83B 'flaw':51B 'forgeri':10A,50B,91C 'host':31B 'instruct':131C 'intern':63B 'let':53B 'list':79B 'make':57B 'malici':104C 'manag':4A,14A,40B,96C,113C 'manager':25A 'may':101C 'network':107C 'note':87B 'oper':3A,13A,36B,39B,95C,112C 'operations':24A 'per':129C 'perform':116C 'prior':98C 'ransomwar':28B,85B 'remot':55B 'request':9A,49B,61B,90C 'requir':125C 'say':67B 'self':30B 'self-host':29B 'send':60B 'server':7A,47B,59B,88C 'server-sid':46B 'side':8A,48B,89C 'sourc':66B 'ssrf':92C,118C 'steal':74B,121C 'system':64B 'updat':128C 'use':71B,86B 'vendor':32B,130C 'vmware':1A,6A,22A,33B,37B 'vrealiz':2A,12A,35B,38B,94C,111C 'vrealize':23A 'vrealize-oper':34B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-03-31T18:15:14+00:00","kev":{"dateAdded":"2022-01-18","dueDate":"2022-02-01","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-21975","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21975","severity":null,"published_at":"2022-01-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T11:39:17+00:00","note":null},{"source":"epss","external_id":"CVE-2021-21975","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21975","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-21975","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21975","severity":null,"published_at":"2021-03-31T18:15:14+00:00","modified_at":"2026-10-02T14:54:50+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}