{"id":"CVE-2021-22005","kind":"vulnerability","aliases":["CVE-2021-22005"],"related":[],"title":"VMware vCenter Server: VMware vCenter Server File Upload Vulnerability","description":"The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.","summary":"Unauthenticated arbitrary file upload in the vCenter Analytics (CEIP) service, reachable on port 443, leads to remote code execution (CVSS 9.8). VMware confirmed exploitation in the wild; public exploits exist including a Metasploit module; used in ransomware campaigns per KEV.","severity":"critical","cvss":9.8,"epss":0.99999,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"VMware vCenter Server","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"VMware vCenter Server 7.0","fixed":["7.0 U2c"],"affected":"< 7.0 U2c","ecosystem":"vendor"},{"name":"VMware vCenter Server 6.7 (virtual appliance)","fixed":["6.7 U3o"],"affected":"< 6.7 U3o","ecosystem":"vendor"},{"name":"VMware Cloud Foundation","fixed":["KB85718 (4.3)","KB85719 (3.10.2.2)"],"affected":"4.x, 3.x (vCenter component)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","on-prem-virtualization","poc-public","ransomware","self-hosted","vcenter","vmware"],"not_affected_if":["no-vcenter-deployed","vcenter-6.5","vcenter-6.7-windows"],"how_to_check":"In vSphere Client or the VAMI (port 5480), check the vCenter version. You are exposed if it is a 7.0 release older than 7.0 U2c, or a 6.7 virtual appliance older than 6.7 U3o. vCenter 6.5 and 6.7 on Windows are not affected. The VMware advisory says exposure does not depend on configuration, so turning CEIP off does not protect you. Also check whether port 443 is reachable from untrusted networks.","fix":"Upgrade vCenter Server 7.0 to 7.0 U2c or later, and 6.7 appliance to 6.7 U3o or later. Cloud Foundation: 4.x apply KB85718 (4.3), 3.x apply KB85719 (3.10.2.2). If you cannot patch immediately, apply the KB85717 workaround, which is temporary only. Do not expose vCenter to the internet.","status":"open","published_at":"2021-09-23T12:15:07+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T20:29:31+00:00","updated_at":"2026-10-23T20:55:09+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-23T20:29:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","summary":"VMware vCenter Server has an arbitrary file upload flaw in its Analytics service, reachable over the network on port 443. An attacker who uploads a crafted file can execute code on the vCenter Server.","category":"infrastructure","who_cares":["vmware","vcenter","on-prem-virtualization"],"confidence":0.7,"analyst_note":"Sources do not list affected or fixed vCenter versions; pull the VMware advisory and KEV required-action text for version ranges and patch steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-vcenter-deployed"],"severity_if_unknown":"critical"},"cost_usd":0.000331,"input_tokens":2112,"output_tokens":239,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources do not list affected or fixed vCenter versions; pull the VMware advisory and KEV required-action text for version ranges and patch steps.","search":"'-2021':11A,14A '-22005':12A,15A '443':60B,108C '6.7':26A '7.0':22A '9.8':67B 'access':105C 'actor':102C 'analyt':54B,98C 'appliance':28A 'arbitrari':48B,92C 'campaign':84B 'ceip':55B 'cloud':30A 'code':64B,118C 'confirm':69B 'contain':90C 'craft':126C 'cve':10A,13A 'cvss':66B 'execut':65B,117C 'exist':76B 'exploit':32B,70B,75B,113C 'file':7A,49B,93C,127C 'foundation':31A 'host':44B 'includ':77B 'infrastructur':33B 'issu':115C 'kev':86B 'lead':61B 'malici':101C 'may':112C 'metasploit':79B 'modul':80B 'network':104C 'on-prem-virtu':34B 'per':85B 'poc':39B 'poc-publ':38B 'port':59B,107C 'prem':36B 'public':40B,74B 'ransomwar':41B,83B 'reachabl':57B 'remot':63B 'self':43B 'self-host':42B 'server':3A,6A,18A,21A,25A,89C,111C,121C 'servic':56B,99C 'special':125C 'unauthent':47B 'upload':8A,50B,94C,123C 'use':81B 'vcenter':2A,5A,17A,20A,24A,45B,53B,88C,110C,120C 'virtual':27A,37B 'vmware':1A,4A,16A,19A,23A,29A,46B,68B 'vulner':9A,95C 'wild':73B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-09-23T12:15:07+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2021-22005","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22005","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2021-22005","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22005","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-22005","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22005","severity":null,"published_at":"2021-09-23T12:15:07+00:00","modified_at":"2026-06-17T03:36:32+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2021-22005:31","url":null,"severity":null,"published_at":"2026-10-23T20:55:09+00:00","modified_at":"2026-10-23T20:55:09+00:00","first_seen_at":"2026-10-23T20:55:09+00:00","fetched_at":"2026-10-23T20:55:09+00:00","note":"Read VMSA-2021-0020 (Broadcom-hosted): fixed 7.0 U2c / 6.7 U3o (appliance); 6.5 and 6.7 Windows unaffected; VMware confirms in-the-wild exploitation; public Metasploit module; workaround KB85717. Exact build numbers not on the pages read."}],"documents":[{"id":880,"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23611","title":"VMSA-2021-0020 vCenter Server updates","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":881,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_vcenter_analytics_file_upload.rb","title":"Metasploit module vmware_vcenter_analytics_file_upload","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":882,"url":"https://www.cisa.gov/news-events/alerts/2021/09/24/vmware-vcenter-server-vulnerability-cve-2021-22005-under-active-exploit","title":"CISA alert CVE-2021-22005 under active exploit","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}