---
id: "CVE-2021-21975"
kind: "vulnerability"
aliases: ["CVE-2021-21975"]
title: "VMware vRealize Operations Manager API: VMware Server Side Request Forgery in vRealize Operations Manager API"
severity: "critical"
cvss: 9.8
epss: 0.78001
exploited: true
status: "open"
category: "vendor"
products: [{"name": "VMware vRealize Operations Manager API", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ransomware", "self-hosted", "vendor", "vmware", "vrealize-operations"]
not_affected_if: ["default-config"]
published_at: "2021-03-31T18:15:14+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21975", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-21975", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21975", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# VMware vRealize Operations Manager API: VMware Server Side Request Forgery in vRealize Operations Manager API

VMware vRealize Operations Manager API before 8.4 has a server-side request forgery flaw that lets a remote attacker make the server send requests to internal systems. The sources say an attacker can use it to steal administrative credentials, and CISA lists it as actively exploited, with ransomware use noted.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VMware vRealize Operations Manager API affected ? fixed ?

## Fix

Upgrade VMware vRealize Operations Manager to 8.4 or later, following VMware's advisory. Rotate administrative credentials on the appliance after patching if it was exposed.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21975
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-21975
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-21975

## From the sources

Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_