CVE-2021-21985
KEV RANSOMWARECRITICAL 9.8EPSS 100.0%
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
- Affected
- VMware vCenter Server and VMware Cloud Foundation
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 10.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 100.00% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-11-03, used in ransomware campaigns
- Nuclei
- critical · CWE-20
- Published
- 2021-05-26
- Updated
- 2026-08-12
Proof-of-concept exploits (11)
- http://packetstormsecurity.com/files/163487/VMware-vCenter-Server-Virtual-SAN-Health-Chec…
- aristosMiliaressis/CVE-2021-219850★ · 2021-07-11
- daedalus/CVE-2021-219852★ · 2023-11-27
- haiclover/CVE-2021-219851★ · 2021-07-12
- haidv35/CVE-2021-219851★ · 2021-07-12
- mauricelambert/CVE-2021-219850★ · 2021-06-01
- sknux/CVE-2021-21985_PoC3★ · 2021-11-09
- testanull/Project_CVE-2021-21985_PoC28★ · 2021-06-07
- xnianq/cve-2021-21985_exp115★ · 2022-01-10
- zidanfanshao/vcenter_tools70★ · 2024-11-17
- alt3kx/CVE-2021-21985_PoC213★ · 2023-01-19
Nuclei templates (1)
Metasploit modules (1)
Exploit collections (3)
- vmware-vcenter-cve-2021-21985-rce.ymlchaitin/xray
- CVE-2021-21985helloexp/0day
- CVE-2021-21985.yamlzan8in/afrog
Security advisories
- https://www.vmware.com/security/advisories/VMSA-2021-0010.html
- http://packetstormsecurity.com/files/162812/VMware-Security-Advisory-2021-0010.html