Live › vulnerability › CVE-2021-21985
Go to dashboardVMware vCenter Server's vSphere Client has a remote code execution flaw in the Virtual SAN Health Check plug-in, which is enabled by default. An attacker with network access to port 443 can run commands with unrestricted privileges on the operating system hosting vCenter Server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 0h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| VMware vCenter Server | vendor | – | – |
| VMware vCenter Server | vendor | 7.0 < 7.0 U2b; 6.7 < 6.7 U3n; 6.5 < 6.5 U3p | 7.0 U2b (7.0.2.00200, build 17958471), 6.7 U3n (6.7.0.48000), 6.5 U3p (6.5.0.35000, build 17994927) |
| VMware Cloud Foundation (vCenter Server) | vendor | 4.x < 4.2.1; 3.x < 3.10.2.1 | 4.2.1, 3.10.2.1 |
4.2.1 (4.x) or 3.10.2.1 (3.x)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
This page as .md · .json · in your agent: get_signal("CVE-2021-21985")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.