CVE
CVE-2021-21972
Vmware · Cloud foundation; Vmware · Vcenter server
- First Reported
- Nov 13, 2026
- Latest Reported
- Nov 13, 2026
CVE Enrichment
- CVSS
- 9.8 CRITICAL
- EPSS
- 99.87%
- EPSS Percentile
- 99.96%
- CISA KEV
- YES — Known Exploited Vulnerability
Description
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- [email protected]
- Published
- 25-Feb-2021 00:15
- Last Modified
- 12-Aug-2026 12:17
- EPSS Date
- 2026-11-12
- CWE
- CWE-22
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:N /
UI:N /
S:U /
C:H /
I:H /
A:H
CISA KEV Details
- Date Added
- 2021-11-03
- Remediation Due
- 2021-11-17
- Known Ransomware Campaign Use
- Known
- Required Action
- Apply updates per vendor instructions.
- Notes
- https://nvd.nist.gov/vuln/detail/CVE-2021-21972
CNA Products / Version Status
- n/a · VMware Cloud Foundation
Source: CNA · [email protected]
Default status: unknown
4.x before 4.2 — affected
3.x before 3.10.1.2 — affected
- n/a · VMware vCenter Server
Source: CNA · [email protected]
Default status: unknown
7.x before 7.0 U1c — affected
6.7 before 6.7 U3l — affected
6.5 before 6.5 U3n — affected
Affected Products / Versions
- vmware / cloud_foundation
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 3.0 · before (exclusive) 3.10.1.2
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* - vmware / cloud_foundation
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 4.0 · before (exclusive) 4.2
cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:a:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:b:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:c:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:d:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:e:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:f:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:update1d:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:update1e:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:update1g:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:update2:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:update2b:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:update2c:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:update2d:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:update2g:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:update3:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:update3d:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:update3f:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.5
cpe:2.3:a:vmware:vcenter_server:6.5:update3k:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:a:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:b:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:d:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:update1:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:update1b:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:update2:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:update2a:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:update2c:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:update3:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:update3a:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:update3b:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:update3f:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:update3g:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 6.7
cpe:2.3:a:vmware:vcenter_server:6.7:update3j:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 7.0
cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 7.0
cpe:2.3:a:vmware:vcenter_server:7.0:a:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 7.0
cpe:2.3:a:vmware:vcenter_server:7.0:b:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 7.0
cpe:2.3:a:vmware:vcenter_server:7.0:c:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 7.0
cpe:2.3:a:vmware:vcenter_server:7.0:d:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 7.0
cpe:2.3:a:vmware:vcenter_server:7.0:update1:*:*:*:*:*:* - vmware / vcenter_server
Source: NVD CPE · affected
Version / affected range: 7.0
cpe:2.3:a:vmware:vcenter_server:7.0:update1a:*:*:*:*:*:*
References
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- CISA Advisory
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- For example, the Twelve group chained CVE-2021-21972 and CVE-2021-22005 to plant a web shell directly on a vCenter appliance, which loaded a backdoor that then established persistence by injecting a shared object into Kaspersky Details ESXi Ransomware Attack and Defenses After vCenter Compromise
CVE (4)
Malware (10)
Threat Actors (4)
MITRE ATT&CK (10)
Vendors (5)
Products (5)
Tools (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.