CVE-2021-21972
VMware vCenter Server Remote Code Execution Vulnerability
Description
CVE-2021-21972 is a critical remote code execution vulnerability in the vSphere Client (HTML5) of VMware vCenter Server. A vCenter Server plugin contains a path traversal flaw that allows a malicious actor with network access to port 443 to upload files and execute commands with unrestricted privileges on the underlying operating system. CISA has added CVE-2021-21972 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and it is known to be used in ransomware campaigns. With an EPSS score of 93.82% (99.86th percentile), this VMware vCenter Server remote code execution vulnerability represents one of the highest-risk threats to virtualized infrastructure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | cloud foundation | >= 3.0, < 3.10.1.2; >= 4.0, < 4.2 |
| vmware | vcenter server | 6.5; 6.7; 7.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.vmware.com/security/advisories/VMSA-2021-0002.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21972(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
Path traversal is a vulnerability where software uses external input to construct a pathname but fails to neutralize special elements like ".." that can resolve the path outside the restricted directory. In CVE-2021-21972, a vCenter Server plugin does not properly validate file upload paths, enabling an unauthenticated attacker to upload arbitrary files to the server’s file system and achieve remote code execution with unrestricted operating system privileges.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
Impact Analysis
CVE-2021-21972 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting the maximum severity for enterprise infrastructure vulnerabilities. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially weaponizable against any internet-exposed vCenter Server. Confidentiality (High): Successful exploitation grants unrestricted command execution on the underlying operating system, providing access to all managed virtual infrastructure, credentials, and sensitive data. Integrity (High): An attacker can modify any file on the system, deploy malicious payloads, alter VMware configurations, or inject backdoors into the vSphere environment. Availability (High): Full operating system access enables an attacker to shut down virtual machines, destroy data, or deploy ransomware across the entire virtualized infrastructure. The known association with ransomware campaigns and the EPSS score of 93.82% underscore the critical urgency of remediation for all organizations running affected vCenter Server versions.
Exploit Maturity
CVE-2021-21972 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog and is known to be used in ransomware campaigns. Multiple public exploits are available, including via Packet Storm Security (Arbitrary File Upload), Packet Storm Security (File Upload RCE), and Packet Storm Security (vCenter 6.5/6.7/7.0 RCE). The EPSS score of 93.82% (99.86th percentile) indicates near-certain exploitation activity. Federal agencies were required to remediate this vulnerability by 2021-11-17 per CISA binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade VMware vCenter Server to 7.0 U1c or later, 6.7 U3l or later, or 6.5 U3n or later. Upgrade VMware Cloud Foundation to 4.2 or later (4.x line) or 3.10.1.2 or later (3.x line).
- Verify that all instances of affected products (VMware vCenter Server 6.5, 6.7, 7.0; VMware Cloud Foundation 3.x before 3.10.1.2 and 4.x before 4.2) have been updated to patched versions.
- If immediate patching is not possible, restrict network access to port 443 on vCenter Server using firewall rules and network segmentation. Block access from untrusted networks and ensure vCenter Server is not exposed to the internet.
- Monitor vCenter Server logs for indicators of compromise, including unusual file upload activity through the vSphere Client plugin, unexpected command execution, and unauthorized changes to virtual machine configurations. Conduct threat hunting for signs of ransomware deployment.
- Implement strict input validation and path canonicalization for file upload functionality as a long-term hardening measure. Ensure all uploaded file paths are validated against allowlisted directories before any write operations are performed.
Technical Details
CVE-2021-21972 is a remote code execution vulnerability in a vCenter Server plugin accessible through the vSphere Client (HTML5). The vulnerability is classified as a path traversal weakness (CWE-22) where the plugin fails to properly validate file upload paths submitted by users. An attacker with network access to port 443 can send specially crafted requests that exploit the path traversal flaw to upload arbitrary files, including webshells or malicious executables, to locations on the underlying operating system. This file upload capability results in unrestricted command execution with the privileges of the vCenter Server service account. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms maximum exploitability: network-accessible, low complexity, no authentication required, and no user interaction needed. Affected versions include vCenter Server 7.x before 7.0 U1c, 6.7 before 6.7 U3l, 6.5 before 6.5 U3n, and Cloud Foundation 4.x before 4.2 and 3.x before 3.10.1.2.
Frequently Asked Questions
Is CVE-2021-21972 being actively exploited?
Yes. CVE-2021-21972 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. It is also known to be used in ransomware campaigns. The EPSS score of 93.82% (99.86th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2021-21972?
CVE-2021-21972 affects VMware vCenter Server versions 7.x before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n, as well as VMware Cloud Foundation versions 4.x before 4.2 and 3.x before 3.10.1.2.
How do I fix CVE-2021-21972?
Apply updates per vendor instructions as detailed in VMware Security Advisory VMSA-2021-0002. Upgrade vCenter Server and Cloud Foundation to the latest patched versions. If immediate patching is not possible, restrict network access to port 443 and monitor for indicators of compromise.
How severe is CVE-2021-21972?
CVE-2021-21972 has a CVSS 3.1 score of 9.8 (CRITICAL) and enables unauthenticated remote code execution with unrestricted OS privileges. Its association with ransomware campaigns and an EPSS score in the 99.86th percentile make it one of the most dangerous VMware vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.