---
id: "CVE-2021-21985"
kind: "vulnerability"
aliases: ["CVE-2021-21985"]
title: "VMware vCenter Server: VMware vCenter Server Improper Input Validation Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.99999
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "VMware vCenter Server", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "VMware vCenter Server", "fixed": ["7.0 U2b (7.0.2.00200, build 17958471)", "6.7 U3n (6.7.0.48000)", "6.5 U3p (6.5.0.35000, build 17994927)"], "affected": "7.0 < 7.0 U2b; 6.7 < 6.7 U3n; 6.5 < 6.5 U3p", "ecosystem": "vendor"}, {"name": "VMware Cloud Foundation (vCenter Server)", "fixed": ["4.2.1", "3.10.2.1"], "affected": "4.x < 4.2.1; 3.x < 3.10.2.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "on-prem", "poc-public", "ransomware", "self-hosted", "vcenter", "vmware", "vsphere"]
not_affected_if: ["managed-hosting"]
published_at: "2021-05-26T15:15:07+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:52:11+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21985", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-21985", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21985", "first_seen_at": "2026-10-23T19:35:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:52:11+00:00"}]
---

# VMware vCenter Server: VMware vCenter Server Improper Input Validation Vulnerability

VMware vCenter Server's vSphere Client has a remote code execution flaw in the Virtual SAN Health Check plug-in, which is enabled by default. An attacker with network access to port 443 can run commands with unrestricted privileges on the operating system hosting vCenter Server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VMware vCenter Server affected ? fixed ?
- vendor:VMware vCenter Server affected 7.0 < 7.0 U2b; 6.7 < 6.7 U3n; 6.5 < 6.5 U3p fixed 7.0 U2b (7.0.2.00200, build 17958471), 6.7 U3n (6.7.0.48000), 6.5 U3p (6.5.0.35000, build 17994927)
- vendor:VMware Cloud Foundation (vCenter Server) affected 4.x < 4.2.1; 3.x < 3.10.2.1 fixed 4.2.1, 3.10.2.1

## How to check

Check the vCenter version and build in the vSphere Client (Help > About) or the VAMI. You are vulnerable if you run 7.0 earlier than 7.0 U2b (build 17958471), 6.7 earlier than 6.7 U3n (VAMI build 18010531), or 6.5 earlier than 6.5 U3p (build 17994927). Also check whether port 443 on vCenter is reachable from untrusted networks.

## Fix

Update vCenter Server to 7.0 U2b, 6.7 U3n or 6.5 U3p. For Cloud Foundation, update to 4.2.1 (4.x) or 3.10.2.1 (3.x). If you cannot patch right away, follow KB83829 and set the affected plugins to incompatible in compatibility-matrix.xml, on both nodes if you run VCHA. Disabling the plugin in the UI does not stop exploitation. Do not expose vCenter to the internet.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-21985
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-21985
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-21985
- 2026-10-23T20:52:11+00:00 analyst — VMSA-2021-0010 gives fixed versions; Broadcom community post gives builds; JPCERT confirms public PoC and scanning since 2021-05-28. I did not link a PoC repo directly; the JPCERT page is the evidence.

## Documents

- [advisory] VMSA-2021-0010 (VMware/Broadcom) https://www.vmware.com/security/advisories/VMSA-2021-0010.html
- [fix] Impacted & Fixed vCenter Server build numbers https://community.broadcom.com/vmware-cloud-foundation/discussion/impacted-fixed-vcenter-server-build-numbers
- [mitigation] KB83829 Disable plugins workaround https://knowledge.broadcom.com/external/article?legacyId=83829
- [poc] JPCERT/CC alert: PoC public, scanning since May 28 2021 https://www.jpcert.or.jp/english/at/2021/at210025.html

## From the sources

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_