Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2021-22005: VMware vCenter Server allows remote code execution via file upload
CVE-2021-22005 · published 5 years ago · actively exploited
Summary
The Analytics component of VMware vCenter Server, Cloud Foundation and vCenter Server can be tricked into running malicious code when a file is uploaded over the standard HTTPS port. An attacker who can reach the server on port 443 could take control of the system. Apply the vendor's security update or restrict network access to the service until the patch is installed.
What to do
- Update vmware cloud_foundation to version 5.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| vmware | vcenter server | All versions |
| vmware | cloud_foundation |
>= 3.0, < 5.0 cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* |
| vmware | vcenter_server |
6.5 6.7 7.0 cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:* |
Original advisory text
VMware vCenter Server File Upload Vulnerability
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
References
- http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP... Exploit Third Party Advisory VDB Entry
- https://www.vmware.com/security/advisories/VMSA-2021-0020.html Patch Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-... US Government Resource
Internet-facing
3 days
and check for signs of compromise
Internal
3 days
and check for signs of compromise
- Known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
>99%
chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published23 Sep 2021
Updated30 Sep 2026
First seen6 Mar 2026
Track software like this
Free during beta