PoC Index

CVE-2021-21972

KEV RANSOMWAREHIGH 10.0EPSS 99.9%

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

CVSS v3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0
10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS
99.87% chance of exploitation in the next 30 days, 100th percentile
CISA KEV
added 2021-11-03, used in ransomware campaigns
Nuclei
critical · CWE-22
Published
2021-02-24
Updated
2026-08-12

Proof-of-concept exploits (35)

Nuclei templates (1)

Metasploit modules (1)

ExploitDB entries (2)

Exploit collections (4)

References

Related