---
id: "CVE-2021-22005"
kind: "vulnerability"
aliases: ["CVE-2021-22005"]
title: "VMware vCenter Server: VMware vCenter Server File Upload Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.99999
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "VMware vCenter Server", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "VMware vCenter Server 7.0", "fixed": ["7.0 U2c"], "affected": "< 7.0 U2c", "ecosystem": "vendor"}, {"name": "VMware vCenter Server 6.7 (virtual appliance)", "fixed": ["6.7 U3o"], "affected": "< 6.7 U3o", "ecosystem": "vendor"}, {"name": "VMware Cloud Foundation", "fixed": ["KB85718 (4.3)", "KB85719 (3.10.2.2)"], "affected": "4.x, 3.x (vCenter component)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "on-prem-virtualization", "poc-public", "ransomware", "self-hosted", "vcenter", "vmware"]
not_affected_if: ["no-vcenter-deployed", "vcenter-6.5", "vcenter-6.7-windows"]
published_at: "2021-09-23T12:15:07+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:55:09+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22005", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-22005", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22005", "first_seen_at": "2026-10-23T19:35:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T20:55:09+00:00"}]
---

# VMware vCenter Server: VMware vCenter Server File Upload Vulnerability

Unauthenticated arbitrary file upload in the vCenter Analytics (CEIP) service, reachable on port 443, leads to remote code execution (CVSS 9.8). VMware confirmed exploitation in the wild; public exploits exist including a Metasploit module; used in ransomware campaigns per KEV.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VMware vCenter Server affected ? fixed ?
- vendor:VMware vCenter Server 7.0 affected < 7.0 U2c fixed 7.0 U2c
- vendor:VMware vCenter Server 6.7 (virtual appliance) affected < 6.7 U3o fixed 6.7 U3o
- vendor:VMware Cloud Foundation affected 4.x, 3.x (vCenter component) fixed KB85718 (4.3), KB85719 (3.10.2.2)

## How to check

In vSphere Client or the VAMI (port 5480), check the vCenter version. You are exposed if it is a 7.0 release older than 7.0 U2c, or a 6.7 virtual appliance older than 6.7 U3o. vCenter 6.5 and 6.7 on Windows are not affected. The VMware advisory says exposure does not depend on configuration, so turning CEIP off does not protect you. Also check whether port 443 is reachable from untrusted networks.

## Fix

Upgrade vCenter Server 7.0 to 7.0 U2c or later, and 6.7 appliance to 6.7 U3o or later. Cloud Foundation: 4.x apply KB85718 (4.3), 3.x apply KB85719 (3.10.2.2). If you cannot patch immediately, apply the KB85717 workaround, which is temporary only. Do not expose vCenter to the internet.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22005
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-22005
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-22005
- 2026-10-23T20:55:09+00:00 analyst — Read VMSA-2021-0020 (Broadcom-hosted): fixed 7.0 U2c / 6.7 U3o (appliance); 6.5 and 6.7 Windows unaffected; VMware confirms in-the-wild exploitation; public Metasploit module; workaround KB85717. Exact build numbers not on the pages read.

## Documents

- [advisory] VMSA-2021-0020 vCenter Server updates https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23611
- [mitigation] CISA alert CVE-2021-22005 under active exploit https://www.cisa.gov/news-events/alerts/2021/09/24/vmware-vcenter-server-vulnerability-cve-2021-22005-under-active-exploit
- [poc] Metasploit module vmware_vcenter_analytics_file_upload https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_vcenter_analytics_file_upload.rb

## From the sources

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_