Live › vulnerability › CVE-2021-22005
Go to dashboardUnauthenticated arbitrary file upload in the vCenter Analytics (CEIP) service, reachable on port 443, leads to remote code execution (CVSS 9.8). VMware confirmed exploitation in the wild; public exploits exist including a Metasploit module; used in ransomware campaigns per KEV.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 0h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| VMware vCenter Server | vendor | – | – |
| VMware vCenter Server 7.0 | vendor | < 7.0 U2c | 7.0 U2c |
| VMware vCenter Server 6.7 (virtual appliance) | vendor | < 6.7 U3o | 6.7 U3o |
| VMware Cloud Foundation | vendor | 4.x, 3.x (vCenter component) | KB85718 (4.3), KB85719 (3.10.2.2) |
3.10.2.2)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
This page as .md · .json · in your agent: get_signal("CVE-2021-22005")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.