CVE-2021-21972
VMware vCenter Server Remote Code Execution Vulnerability
Published Feb 24, 2021 · updated Aug 11, 2026 · vmware cloud foundation
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Feb 24, 2021 · Catalog
Detected
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Clou
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Nov 17, 2021 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Aug 11, 2026 · Catalog
Updated
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Clou
Required action
Apply updates per vendor instructions.
CISA due date Nov 17, 2021
Affected
- cpe vmware/cloud foundationversion unspecified
- cpe vmware/vcenter server6.5
- vendor VMware vCenter Serverversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2021-21972
VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.
cisa.gov - CVE.orgVulnerability recordCVE-2021-21972
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2021-21972
30-day exploitation probability 99.9%
first.org - Exploit DatabasePublic exploit reference49602
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit DatabasePublic exploit reference50056
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit ModulesPublic exploit moduleexploit_multi/http/vmware_vcenter_uploadova_rce
Public module reference (manual). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2021-21972
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Se
nvd.nist.gov - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com