Read the docs
TI-2021-05061 Aliases CVE-2021-22017GHSA-w46j-w72r-9x98

Rhttproxy as used in vCenter Server contains a vulnerability due to improper…

Priority HIGH 81Exploited in the wildPublished · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.

Why it matters now

Exploitation Active In CISA KEV since 2022-01-10CISA due date 2022-01-24
EPSS 0.49177 98th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—VMware vCenter Server, VMware Cloud FoundationVMware vCenter Server(6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation 3.x before 3.10.2.2—No fix listedCNA
  • VMware vCenter Server, VMware Cloud Foundation Vendor— Affected VMware vCenter Server(6.7 before 6.7 U3o and 6.5 before 6.5 U3q) and VMware Cloud Foundation 3.x before 3.10.2.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*6.7VulnerableVMware
  • cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:* Versions 6.7 Vulnerable ·VMware

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2022-01-10 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2021-22017
  3. 2026-10-03 Alias added: GHSA-w46j-w72r-9x98

References

Patch 1

  • TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05049 Path traversal in VMware vCenter Server, VMware Cloud Foundation KEVCVSS 3.1CRITICAL 9.8
See all 80 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences