{"id":2593,"date":"2021-06-07T10:07:38","date_gmt":"2021-06-07T08:07:38","guid":{"rendered":"https:\/\/fortgale.com\/news\/?p=2593"},"modified":"2026-06-08T23:08:19","modified_gmt":"2026-06-08T23:08:19","slug":"vmware-vcenter-vulnerability","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/emerging-threats\/vmware-vcenter-vulnerability\/","title":{"rendered":"VMware vCenter vulnerability"},"content":{"rendered":"\n

A Remote Command Execution vulnerability has been identified in VMware vCenter products. The vulnerability has been assigned a CVSS score of 9.8 (official advisory<\/a>). CVE: 2021-21985, 2021-21986<\/p>\n

The vulnerability permits potential threat actors to access vulnerable servers and execute privileged commands for system compromise.<\/p>\n\n\n\n

\n

Vulnerable Systems<\/h2>\n\n\n\n
\"\"<\/figure>
\n

vCenter Server systems are products frequently deployed within enterprise networks. The presence of this vulnerability within the perimeter reduces exposure to internal access vectors only.<\/p>\n

The criticality of this vulnerability stems from the possibility that a threat actor with network access to port 443 can gain access to the VMware server.<\/p>\n\n\n\n

Systems potentially exposed on public networks can be identified. In Italy, approximately 143<\/strong> systems are potentially vulnerable. Globally, approximately 5 000<\/strong>. Security patches must be applied; to mitigate risk, restricting access from the internet is recommended.<\/p>\n<\/div><\/div>\n<\/div><\/div>\n\n\n\n

Vulnerability Details<\/h2>\n\n\n\n
Overview:<\/h5>\n\n\n\n

The vSphere client (HTML5) contains a Remote Code Execution vulnerability due to insufficient input validation in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server. This flaw can be exploited through T1190 (Exploit Public-Facing Application) attack vectors. Organizations implementing Cybersecurity Advisory<\/a> protocols should prioritize patching this exposure.<\/p>\n\n\n\n

Exploitation Method:<\/h5>\n\n\n\n

A threat actor with network access to port 443 can exploit this vulnerability to execute commands on the vCenter Server.<\/p>\n\n\n\n

Vulnerable Systems Detail:<\/h5>\n\n\n\n
Product<\/td>Version<\/td>Running On<\/td>CVE Identifier<\/td>CVSSv3<\/td>Severity<\/td>Fixed Version<\/td>Workarounds<\/td>Additional Documentation<\/td><\/tr>
vCenter Server<\/td>7.0<\/td>Any<\/td>CVE-2021-21985<\/td>9.8<\/a><\/td>Critical <\/td>7.0 U2b<\/a><\/td>KB83829<\/a><\/td>FAQ<\/a><\/td><\/tr>
vCenter Server<\/td>6.7<\/td>Any<\/td>CVE-2021-21985<\/td>9.8<\/a><\/td>Critical <\/td>6.7 U3n<\/a><\/td>KB83829<\/a><\/td>FAQ<\/a><\/td><\/tr>
vCenter Server<\/td>6.5<\/td>Any<\/td>CVE-2021-21985<\/td>9.8<\/a><\/td>Critical <\/td>6.5 U3p<\/a><\/td>KB83829<\/a><\/td>FAQ<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n","protected":false},"excerpt":{"rendered":"

VMware vCenter critical vulnerability: unauthenticated RCE primitives, exposure metrics, exploitation evidence and remediation steps for affected estates.<\/p>\n","protected":false},"author":1,"featured_media":2599,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[14,15,87,3295,89,3296,264,287,310,316,3268,372,378,3294],"class_list":["post-2593","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-emerging-threats","tag-2021-21985","tag-2021-21986","tag-critical","tag-critical-cve","tag-cve","tag-hypervisor-management","tag-patch","tag-rce","tag-server","tag-shodan","tag-unauthenticated-rce","tag-vcenter","tag-vmware","tag-vmware-vcenter"],"_links":{"self":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2593","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/comments?post=2593"}],"version-history":[{"count":1,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2593\/revisions"}],"predecessor-version":[{"id":9905,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/posts\/2593\/revisions\/9905"}],"wp:attachment":[{"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/media?parent=2593"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/categories?post=2593"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fortgale.com\/blog\/wp-json\/wp\/v2\/tags?post=2593"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}