{"id":"CVE-2021-21985","kind":"vulnerability","aliases":["CVE-2021-21985"],"related":[],"title":"VMware vCenter Server: VMware vCenter Server Improper Input Validation Vulnerability","description":"The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.","summary":"VMware vCenter Server's vSphere Client has a remote code execution flaw in the Virtual SAN Health Check plug-in, which is enabled by default. An attacker with network access to port 443 can run commands with unrestricted privileges on the operating system hosting vCenter Server.","severity":"critical","cvss":10.0,"epss":0.99999,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"VMware vCenter Server","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"VMware vCenter Server","fixed":["7.0 U2b (7.0.2.00200, build 17958471)","6.7 U3n (6.7.0.48000)","6.5 U3p (6.5.0.35000, build 17994927)"],"affected":"7.0 < 7.0 U2b; 6.7 < 6.7 U3n; 6.5 < 6.5 U3p","ecosystem":"vendor"},{"name":"VMware Cloud Foundation (vCenter Server)","fixed":["4.2.1","3.10.2.1"],"affected":"4.x < 4.2.1; 3.x < 3.10.2.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","on-prem","poc-public","ransomware","self-hosted","vcenter","vmware","vsphere"],"not_affected_if":["managed-hosting"],"how_to_check":"Check the vCenter version and build in the vSphere Client (Help > About) or the VAMI. You are vulnerable if you run 7.0 earlier than 7.0 U2b (build 17958471), 6.7 earlier than 6.7 U3n (VAMI build 18010531), or 6.5 earlier than 6.5 U3p (build 17994927). Also check whether port 443 on vCenter is reachable from untrusted networks.","fix":"Update vCenter Server to 7.0 U2b, 6.7 U3n or 6.5 U3p. For Cloud Foundation, update to 4.2.1 (4.x) or 3.10.2.1 (3.x). If you cannot patch right away, follow KB83829 and set the affected plugins to incompatible in compatibility-matrix.xml, on both nodes if you run VCHA. Disabling the plugin in the UI does not stop exploitation. Do not expose vCenter to the internet.","status":"open","published_at":"2021-05-26T15:15:07+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:23+00:00","updated_at":"2026-10-23T20:52:11+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-23T20:29:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","summary":"VMware vCenter Server's vSphere Client has a remote code execution flaw in the Virtual SAN Health Check plug-in, which is enabled by default. An attacker with network access to port 443 can run commands with unrestricted privileges on the operating system hosting vCenter Server.","category":"infrastructure","who_cares":["vmware","vcenter","vsphere","self-hosted"],"confidence":0.8,"analyst_note":"Sources do not list affected or fixed vCenter versions or the patch/workaround; check the VMware advisory for CVE-2021-21985 and the fixed build numbers.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"critical"},"cost_usd":0.000354,"input_tokens":2185,"output_tokens":270,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources do not list affected or fixed vCenter versions or the patch/workaround; check the VMware advisory for CVE-2021-21985 and the fixed build numbers.","search":"'-2021':12A,15A '-21985':13A,16A '443':76B,131C 'access':73B,128C 'actor':125C 'attack':70B 'check':60B,111C 'client':48B,92C 'cloud':24A 'code':52B,97C 'command':79B,138C 'contain':94C 'cve':11A,14A 'default':68B,119C 'due':100C 'enabl':66B,117C 'execut':53B,98C,137C 'exploit':28B,133C 'flaw':54B 'foundation':25A 'health':59B,110C 'host':39B,87B,148C 'html5':93C 'improp':7A 'infrastructur':29B 'input':8A,104C 'issu':135C 'lack':102C 'malici':124C 'may':132C 'network':72B,127C 'on-prem':30B 'oper':85B,145C 'plug':62B,113C 'plug-in':61B,112C 'poc':34B 'poc-publ':33B 'port':75B,130C 'prem':32B 'privileg':82B,141C 'public':35B 'ransomwar':36B 'remot':51B,96C 'run':78B 'san':58B,109C 'self':38B 'self-host':37B 'server':3A,6A,19A,22A,27A,45B,89B,122C,150C 'system':86B,146C 'under':144C 'unrestrict':81B,140C 'valid':9A,105C 'vcenter':2A,5A,18A,21A,26A,40B,44B,88B,121C,149C 'virtual':57B,108C 'vmware':1A,4A,17A,20A,23A,41B,43B 'vsphere':42B,47B,91C 'vulner':10A,99C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-05-26T15:15:07+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2021-21985","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21985","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T20:35:39+00:00","note":null},{"source":"epss","external_id":"CVE-2021-21985","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-21985","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-21985","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21985","severity":null,"published_at":"2021-05-26T15:15:07+00:00","modified_at":"2026-08-12T05:17:36+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2021-21985:30","url":null,"severity":null,"published_at":"2026-10-23T20:52:11+00:00","modified_at":"2026-10-23T20:52:11+00:00","first_seen_at":"2026-10-23T20:52:11+00:00","fetched_at":"2026-10-23T20:52:11+00:00","note":"VMSA-2021-0010 gives fixed versions; Broadcom community post gives builds; JPCERT confirms public PoC and scanning since 2021-05-28. I did not link a PoC repo directly; the JPCERT page is the evidence."}],"documents":[{"id":876,"url":"https://www.vmware.com/security/advisories/VMSA-2021-0010.html","title":"VMSA-2021-0010 (VMware/Broadcom)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":877,"url":"https://community.broadcom.com/vmware-cloud-foundation/discussion/impacted-fixed-vcenter-server-build-numbers","title":"Impacted & Fixed vCenter Server build numbers","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":879,"url":"https://knowledge.broadcom.com/external/article?legacyId=83829","title":"KB83829 Disable plugins workaround","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":878,"url":"https://www.jpcert.or.jp/english/at/2021/at210025.html","title":"JPCERT/CC alert: PoC public, scanning since May 28 2021","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}