Riskcovery

CVE-2021-21985

State
Published
Severity
9.8 Critical
Published
May 26, 2021
Updated
Aug 12, 2026
Reserved
Jan 4, 2021

Read the record on cve.org

Description

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

  • CWE-20 Improper Input Validation
  • CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
VMware vCenter Server and VMware Cloud Foundationn/a
  • VMware vCenter Server (7.x before 7.0 U2b, 6.7 before 6.7 U3n, 6.5 before 6.5 U3p) and VMware Cloud Foundation (4.x before 4.2.1, 3.x before 3.10.2.1)Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.