{"id":"CVE-2021-21972","published":"2021-02-24T17:15:15Z","modified":"2026-08-12T05:17:35Z","title":"VMware vCenter Server Remote Code Execution Vulnerability","vendor":"VMware","product":"vCenter Server","tier":"core","eol":null,"description":{"text":"The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).","provenance":"source","from":"NVD"},"summary":{"text":"The vSphere Client (HTML5) in VMware vCenter Server contains a remote code execution flaw in a vCenter Server plugin, stemming from path traversal weaknesses. An attacker with network access to port 443 and no authentication or user interaction required can execute commands with unrestricted privileges on the operating system hosting vCenter Server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:22Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99865,"percentile":0.99962,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-21972","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-02-25","exploitedFirstSeen":"2021-02-25","ransomware":true,"evidence":[{"url":"https://outpost24.com/blog/attackers-collaborate-to-exploit-cve-2021-21972-and-cve-2021-21973/","date":"2021-02-25"},{"url":"https://www.ncsc.gov.uk/files/Advisory%20Further%20TTPs%20associated%20with%20SVR%20cyber%20actors.pdf","date":"2021-05-07"},{"url":"https://blog.talosintelligence.com/2021/06/necro-python-bot-adds-new-tricks.html","date":"2021-06-03"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://www.fortiguard.com/threat-signal-report/4295","date":"2021-11-19"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/ransomware-_-2022-spotlight-report_compressed.pdf","date":"2022-01-26"},{"url":"https://www.tenable.com/blog/contileaks-chats-reveal-over-30-vulnerabilities-used-by-conti-ransomware-affiliates","date":"2022-03-24"},{"url":"https://cisa.gov/news-events/alerts/2022/04/27/2021-top-routinely-exploited-vulnerabilities","date":"2022-04-28"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-117a","date":"2022-04-28"},{"url":"https://static.tenable.com/marketing/whitepapers/Whitepaper-Ransomware_Ecosystem.pdf","date":"2022-06-22"}],"evidenceTotal":368,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-23","name":"Relative Path Traversal"}],"references":[{"url":"http://packetstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0002.html","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0002.html","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21972","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"exploitation_technique","evidence":[],"comment":" CVE-2021-21972 is a RCE vulnerability affecting VMware vCenter servers. An attacker with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Code Execution","mappingType":"primary_impact","evidence":[],"comment":" CVE-2021-21972 is a RCE vulnerability affecting VMware vCenter servers. An attacker with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.","confidence":"medium","confidenceNote":"CTID KEV capability group \"code execution\" is generic"}],"reports":[{"id":"SRC-8b6e5f3c2592261e3f88","title":"Advisory further TTPs associated with SVR cyber actors","publisher":"ncsc.gov.uk","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf","date":null,"mentions":[{"quote":"• CVE-2021-21972 VMWare vSphere","start":2880,"end":2911}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-9143","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9143","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":49602,"url":"https://www.exploit-db.com/exploits/49602","title":"VMware vCenter Server 7.0 - Unauthenticated File Upload","type":"webapps","platform":"multiple","date":"2021-03-01","verified":false,"provenance":"source"},{"id":50056,"url":"https://www.exploit-db.com/exploits/50056","title":"VMware vCenter Server 7.0 - Remote Code Execution (RCE) (Unauthenticated)","type":"webapps","platform":"multiple","date":"2021-06-24","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2021-03-01"},"pocGithub":{"count":25,"skipped":2,"earliest":"2020-03-11","earliestUrl":"https://github.com/psc4re/NSE-scripts","repos":[{"name":"Schira4396/VcenterKiller","url":"https://github.com/Schira4396/VcenterKiller","stars":1482,"created":"2022-10-04"},{"name":"NS-Sp4ce/CVE-2021-21972","url":"https://github.com/NS-Sp4ce/CVE-2021-21972","stars":497,"created":"2021-02-24"},{"name":"horizon3ai/CVE-2021-21972","url":"https://github.com/horizon3ai/CVE-2021-21972","stars":270,"created":"2021-02-24"},{"name":"psc4re/NSE-scripts","url":"https://github.com/psc4re/NSE-scripts","stars":162,"created":"2020-03-11"},{"name":"QmF0c3UK/CVE-2021-21972-vCenter-6.5-7.0-RCE-POC","url":"https://github.com/QmF0c3UK/CVE-2021-21972-vCenter-6.5-7.0-RCE-POC","stars":136,"created":"2021-02-24"}]},"metasploit":[{"name":"VMware vCenter Server Unauthenticated OVA File Upload RCE","module":"exploit/multi/http/vmware_vcenter_uploadova_rce","type":"exploit","disclosureDate":"2021-02-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/vmware_vcenter_uploadova_rce.rb"}],"nuclei":[{"id":"CVE-2021-21972","name":"VMware vSphere Client (HTML5) - Remote Code Execution","severity":"critical","path":"http/cves/2021/CVE-2021-21972.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21972.yaml"}],"first":{"date":"2020-03-11","source":"PoC-in-GitHub","url":"https://github.com/psc4re/NSE-scripts"},"provenance":"source"},"detections":{"cveRules":[{"title":"CVE-2021-21972 VSphere Exploitation","id":"179ed852-0f9b-4009-93a7-68475910fd86","level":"high","status":"test","path":"rules-emerging-threats/2021/Exploits/CVE-2021-21972/web_cve_2021_21972_vsphere_unauth_rce_exploit.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-21972/web_cve_2021_21972_vsphere_unauth_rce_exploit.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.html","http://packetstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.html","http://packetstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2020-03-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2021-02-23, Exploit-DB 2021-03-01","url":"https://github.com/psc4re/NSE-scripts","provenance":"source"},{"date":"2021-02-24","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21972","provenance":"source"},{"date":"2021-02-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://outpost24.com/blog/attackers-collaborate-to-exploit-cve-2021-21972-and-cve-2021-21973/","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9143","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":252},"priority":{"score":83.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2073 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9996"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 2 Exploit-DB entries; 25 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}