Path traversal in VMware vCenter Server
Priority CRITICAL 100Exploited in the wildCWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Why it matters now
Exploitation Active In CISA KEV since 2021-11-03CISA due date 2021-11-17Known ransomware use
EPSS 0.99865 99th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed VMware Cloud Foundation: 4.2, 3.10.1.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | VMware vCenter Server | 7.x before 7.0 U1c; 6.7 before 6.7 U3l; 6.5 before 6.5 U3n | — | No fix listed | CNA |
| — | VMware Cloud Foundation | 4 to before 4.2; 3 to before 3.10.1.2 | 4.2, 3.10.1.2 | Patch available | CNA |
- VMware vCenter Server Vendor— Affected 7.x before 7.0 U1c; 6.7 before 6.7 U3l; 6.5 before 6.5 U3n Fixed in — No fix listed CNA
- VMware Cloud Foundation Vendor— Affected 4 to before 4.2; 3 to before 3.10.1.2 Fixed in 4.2, 3.10.1.2 Patch available CNA
CPE configurations NVD · 42
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* | 3.0 to before 3.10.1.2; 4.0 to before 4.2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:* | 6.5 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:* | 6.5 a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:* | 6.5 b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:* | 6.5 c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:* | 6.5 d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:* | 6.5 e | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:* | 6.5 f | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:* | 6.5 update1d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:* | 6.5 update1e | Vulnerable | VMware |
- cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* Versions 3.0 to before 3.10.1.2; 4.0 to before 4.2 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:* Versions 6.5 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:* Versions 6.5 a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:* Versions 6.5 b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:* Versions 6.5 c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:* Versions 6.5 d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:* Versions 6.5 e Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:* Versions 6.5 f Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:* Versions 6.5 update1d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:* Versions 6.5 update1e Vulnerable ·VMware
Show 32 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:* | 6.5 update1g | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:* | 6.5 update2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:* | 6.5 update2b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:* | 6.5 update2c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:* | 6.5 update2d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:* | 6.5 update2g | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:* | 6.5 update3 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:* | 6.5 update3d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:* | 6.5 update3f | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:* | 6.5 update3k | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:* | 6.7 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:* | 6.7 a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:* | 6.7 b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:* | 6.7 d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:* | 6.7 update1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:* | 6.7 update1b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:* | 6.7 update2 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:* | 6.7 update2a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:* | 6.7 update2c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:* | 6.7 update3 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:* | 6.7 update3a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:* | 6.7 update3b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:* | 6.7 update3f | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:* | 6.7 update3g | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:* | 6.7 update3j | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* | 7.0 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:* | 7.0 a | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:* | 7.0 b | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:* | 7.0 c | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:* | 7.0 d | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* | 7.0 update1 | Vulnerable | VMware |
| cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:* | 7.0 update1a | Vulnerable | VMware |
- cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:* Versions 6.5 update1g Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:* Versions 6.5 update2 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:* Versions 6.5 update2b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:* Versions 6.5 update2c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:* Versions 6.5 update2d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:* Versions 6.5 update2g Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:* Versions 6.5 update3 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:* Versions 6.5 update3d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:* Versions 6.5 update3f Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:* Versions 6.5 update3k Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:* Versions 6.7 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:* Versions 6.7 a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:* Versions 6.7 b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:* Versions 6.7 d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:* Versions 6.7 update1 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:* Versions 6.7 update1b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:* Versions 6.7 update2 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:* Versions 6.7 update2a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:* Versions 6.7 update2c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:* Versions 6.7 update3 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:* Versions 6.7 update3a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:* Versions 6.7 update3b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:* Versions 6.7 update3f Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:* Versions 6.7 update3g Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:* Versions 6.7 update3j Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:* Versions 7.0 a Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:* Versions 7.0 b Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:* Versions 7.0 c Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:* Versions 7.0 d Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* Versions 7.0 update1 Vulnerable ·VMware
- cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:* Versions 7.0 update1a Vulnerable ·VMware
Remediation
- Fix · CNA VMware Cloud Foundation Fixed in 4.2, 3.10.1.2
Timeline
- 2021-11-03 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2021-21972
- 2026-10-03 Alias added: GHSA-c9cr-34rr-8gpr
References
Exploit 3
More VMware Cloud Foundation vulnerabilities
- TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07131 Code injection in VMware Workspace ONE Access and Identity Manager KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05049 Path traversal in VMware vCenter Server, VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05029 Improper input validation in VMware vCenter Server and VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-21972 · CVE Program
- CVE-2021-21972 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-c9cr-34rr-8gpr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences