CVE-2021-21985
VMware vCenter Server Improper Input Validation Vulnerability
Description
CVE-2021-21985 is a critical remote code execution vulnerability in the vSphere Client (HTML5) of VMware vCenter Server caused by improper input validation in the Virtual SAN Health Check plug-in, which is enabled by default. A malicious actor with network access to port 443 can exploit this flaw to execute commands with unrestricted privileges on the underlying operating system hosting vCenter Server. CISA has added CVE-2021-21985 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and it is known to be used in ransomware campaigns. With an EPSS score of 94.41% (99.98th percentile), this VMware vCenter Server vulnerability represents one of the most actively targeted threats to enterprise virtualization infrastructure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| vmware | vcenter server | 6.5; 6.7; 7.0 |
| vmware | cloud foundation | >= 3.0, < 3.10.2.1; >= 4.0, < 4.2.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/162812/VMware-Security-Advisory-2021-0010.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/163487/VMware-vCenter-Server-Virtual-SAN-Health-Check-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.vmware.com/security/advisories/VMSA-2021-0010.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21985(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Improper Input Validation occurs when software receives input but does not validate that it has the properties required for safe processing. In CVE-2021-21985, the Virtual SAN Health Check plug-in in vCenter Server fails to properly validate user-supplied input, allowing an attacker to inject malicious data that leads to remote code execution on the underlying operating system.
Learn more: CWE-20 — Improper Input Validation
CWE-470: Use of Externally-Controlled Input to Select Classes or Code
This weakness occurs when software uses external input to determine which classes to instantiate or which code paths to execute. In CVE-2021-21985, the lack of input validation in the Virtual SAN Health Check plug-in allows attackers to control class selection or code execution paths, leading to unrestricted command execution on the host system.
Learn more: CWE-470 — Use of Externally-Controlled Input to Select Classes or Code
CWE-918: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery occurs when a web application fetches a remote resource without validating the user-supplied URL. In the context of CVE-2021-21985, the SSRF weakness in the Virtual SAN Health Check plug-in may allow an attacker to coerce the vCenter Server into making unintended requests to internal services, further facilitating exploitation.
Learn more: CWE-918 — Server-Side Request Forgery (SSRF)
Impact Analysis
CVE-2021-21985 carries a CVSS 3.1 score of 9.8 (CRITICAL), indicating the highest severity level. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially exploitable against any vCenter Server with port 443 accessible. Confidentiality (High): Successful exploitation provides unrestricted operating system command execution, granting access to all managed virtual infrastructure, credentials, encryption keys, and sensitive organizational data stored on or managed by the vCenter Server. Integrity (High): An attacker can modify any system file, deploy malicious virtual machines, alter security configurations, or install persistent backdoors across the VMware environment. Availability (High): Complete control over the host operating system allows the attacker to shut down all managed virtual machines, corrupt data, or deploy ransomware across the entire virtualization infrastructure. The combination of the 94.41% EPSS score and confirmed ransomware usage makes CVE-2021-21985 an immediate, critical remediation priority.
Exploit Maturity
CVE-2021-21985 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog and is known to be used in ransomware campaigns. Public exploit code is available via Packet Storm Security, providing attackers with a ready-to-use remote code execution tool targeting the Virtual SAN Health Check plug-in. The EPSS score of 94.41% (99.98th percentile) indicates near-certain exploitation activity, placing this among the most actively targeted VMware vulnerabilities. Federal agencies were required to remediate this vulnerability by 2021-11-17 per CISA binding operational directive, reflecting the extreme urgency of this threat.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Refer to VMware Security Advisory VMSA-2021-0010 for the latest patched versions of vCenter Server and Cloud Foundation.
- Verify that all instances of affected products (VMware vCenter Server versions 6.5, 6.7, and 7.0; VMware Cloud Foundation versions 3.x before 3.10.2.1 and 4.x before 4.2.1) have been updated to patched versions.
- As an interim mitigation, disable the Virtual SAN Health Check plug-in if it is not required. This plug-in is enabled by default in vCenter Server and serves as the attack surface for this vulnerability.
- Restrict network access to port 443 on vCenter Server using firewall rules and network segmentation. Block access from untrusted networks and ensure vCenter Server is not directly exposed to the internet. Monitor for unusual activity targeting the vSAN Health Check endpoints.
- Implement comprehensive input validation and sanitization for all plug-in interfaces as a long-term hardening measure. Regularly audit enabled plug-ins and disable any that are not actively required. Conduct threat hunting for indicators of ransomware deployment or unauthorized command execution.
Technical Details
CVE-2021-21985 is a remote code execution vulnerability in the vSphere Client (HTML5) caused by improper input validation (CWE-20) in the Virtual SAN Health Check plug-in, which is enabled by default in VMware vCenter Server. The vulnerability involves multiple weakness types: improper input validation allows malicious data to reach internal processing logic, use of externally-controlled input to select classes or code (CWE-470) enables attackers to influence which code paths are executed, and server-side request forgery (CWE-918) may allow the server to be coerced into making unintended internal requests. Together, these weaknesses allow an unauthenticated attacker with network access to port 443 to exploit the plug-in and execute arbitrary commands with unrestricted privileges on the underlying operating system. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms maximum exploitability: network-accessible, low complexity, no authentication, and no user interaction required. Affected versions include vCenter Server 6.5, 6.7, and 7.0, as well as Cloud Foundation 3.x before 3.10.2.1 and 4.x before 4.2.1.
Frequently Asked Questions
Is CVE-2021-21985 being actively exploited?
Yes. CVE-2021-21985 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. It is also known to be associated with ransomware campaigns. The EPSS score of 94.41% (99.98th percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2021-21985?
CVE-2021-21985 affects VMware vCenter Server versions 6.5, 6.7, and 7.0, as well as VMware Cloud Foundation versions 3.x before 3.10.2.1 and 4.x before 4.2.1. The vulnerability is in the Virtual SAN Health Check plug-in, which is enabled by default.
How do I fix CVE-2021-21985?
Apply updates per vendor instructions as detailed in VMware Security Advisory VMSA-2021-0010. As an interim mitigation, disable the Virtual SAN Health Check plug-in if not needed. Restrict network access to port 443 and monitor for indicators of compromise.
How severe is CVE-2021-21985?
CVE-2021-21985 has a CVSS 3.1 score of 9.8 (CRITICAL) and enables unauthenticated remote code execution with unrestricted OS privileges via a default-enabled plug-in. Its association with ransomware campaigns and an EPSS score in the 99.98th percentile make it an immediate remediation priority.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.