{"id":"CVE-2021-21975","published":"2021-03-31T18:15:14Z","modified":"2026-10-02T14:54:50Z","title":"VMware Server Side Request Forgery in vRealize Operations Manager API","vendor":"VMware","product":"vRealize Operations Manager API","tier":"core","eol":null,"description":{"text":"Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.","provenance":"source","from":"NVD"},"summary":{"text":"A Server-Side Request Forgery flaw in the VMware vRealize Operations Manager API component allows an attacker to make the server issue requests on their behalf. Exploitation requires only network access to the API, with no authentication or user interaction, and the attacker can use it to steal administrative credentials.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:19Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.78001,"percentile":0.99573,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-01-18","dueDate":"2022-02-01","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-21975","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-06-01","exploitedFirstSeen":"2021-06-01","ransomware":true,"evidence":[{"url":"https://unit42.paloaltonetworks.com/network-attack-trends-february-april-2021/","date":"2021-06-01"},{"url":"https://vblocalhost.com/uploads/VB2021-50.pdf","date":"2021-10-07"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-01-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-17&host_type=src&vulnerability=cve-2021-21975","date":"2023-11-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-19&host_type=src&vulnerability=cve-2021-21975","date":"2023-11-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-20&host_type=src&vulnerability=cve-2021-21975","date":"2023-11-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-21&host_type=src&vulnerability=cve-2021-21975","date":"2023-11-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-23&host_type=src&vulnerability=cve-2021-21975","date":"2023-11-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-29&host_type=src&vulnerability=cve-2021-21975","date":"2023-11-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-30&host_type=src&vulnerability=cve-2021-21975","date":"2023-11-30"}],"evidenceTotal":714,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0004.html","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0004.html","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21975","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Server-Side Request Forgery (SSRF)","mappingType":"exploitation_technique","evidence":[],"comment":"This Server-Side Request Forgery (SSRF) vulnerability is exploited by an attacker with network access to the VMware server. This vulnerability enables the attacker to exploit an unauthenticated endpoint to send crafted requests to internal or external systems. By doing so, the attacker can potentially steal administrative credentials. Once these credentials are compromised, the attacker could gain maximum privileges within the application, enabling them to alter configurations and intercept sensitive data. This exploitation could lead to unauthorized access and manipulation of the application.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-9146","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9146","exploited":true,"exploitedSince":"2022-01-18","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":8,"skipped":0,"earliest":"2021-03-31","earliestUrl":"https://github.com/Henry4E36/VMWare-vRealize-SSRF","repos":[{"name":"rabidwh0re/REALITY_SMASHER","url":"https://github.com/rabidwh0re/REALITY_SMASHER","stars":37,"created":"2021-04-06"},{"name":"GuayoyoCyber/CVE-2021-21975","url":"https://github.com/GuayoyoCyber/CVE-2021-21975","stars":27,"created":"2021-04-01"},{"name":"Al1ex/CVE-2021-21975","url":"https://github.com/Al1ex/CVE-2021-21975","stars":13,"created":"2021-03-31"},{"name":"Henry4E36/VMWare-vRealize-SSRF","url":"https://github.com/Henry4E36/VMWare-vRealize-SSRF","stars":12,"created":"2021-03-31"},{"name":"murataydemir/CVE-2021-21975","url":"https://github.com/murataydemir/CVE-2021-21975","stars":4,"created":"2021-04-02"}]},"metasploit":[{"name":"VMware vRealize Operations (vROps) Manager SSRF RCE","module":"exploit/linux/http/vmware_vrops_mgr_ssrf_rce","type":"exploit","disclosureDate":"2021-03-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_vrops_mgr_ssrf_rce.rb"}],"nuclei":[{"id":"CVE-2021-21975","name":"vRealize Operations Manager API - Server-Side Request Forgery","severity":"high","path":"http/cves/2021/CVE-2021-21975.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21975.yaml"}],"first":{"date":"2021-03-30","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_vrops_mgr_ssrf_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"}],"timeline":[{"date":"2021-03-30","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2021-03-31","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_vrops_mgr_ssrf_rce.rb","provenance":"source"},{"date":"2021-03-31","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21975","provenance":"source"},{"date":"2021-06-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/network-attack-trends-february-april-2021/","provenance":"source"},{"date":"2022-01-18","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-01-18","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9146","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":293},"priority":{"score":78.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1978 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9957"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 8 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}