Back to CVE Browser

CVE-2021-21985

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score95.8860%

EPSS Percentile95.73th

Published2021-05-26

Last Modified2025-10-30

Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

Affected Platforms (CPE)

📦

Vmware

Vcenter Server

= 6.5= 6.7= 7.0

📦

Vmware

Cloud Foundation

>= 3.0 and < 3.10.2.1>= 4.0 and < 4.2.1

References & Advisories

🔗 http://packetstormsecurity.com/files/162812/VMware-Security-Advisory-2021-0010.html

🔗 http://packetstormsecurity.com/files/163487/VMware-vCenter-Server-Virtual-SAN-Health-Check-Remote-Code-Execution.html

🔗 https://www.vmware.com/security/advisories/VMSA-2021-0010.html

🔗 http://packetstormsecurity.com/files/162812/VMware-Security-Advisory-2021-0010.html

🔗 http://packetstormsecurity.com/files/163487/VMware-vCenter-Server-Virtual-SAN-Health-Check-Remote-Code-Execution.html

🔗 https://www.vmware.com/security/advisories/VMSA-2021-0010.html

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21985

Related Security Intelligence Articles

Daily Global Cyber Threat Intelligence Digest — July 21, 2026

Comprehensive breakdown of critical vulnerability advisories across VMware vCenter, F5 BIG-IP, and GitLab platforms, alongside threat actor reconnaissance trends and ransomware response strategies.

Related Vulnerabilities

CVE-2026-659756.5

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but n...

CVE-2026-542496.8

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 t...

Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserl...

CVE-2026-674356.0

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 6.0....