Back to CVE Browser

CVE-2021-22005

🔥 Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score25.7160%

EPSS Percentile92.12th

Published2021-09-23

Last Modified2025-10-30

Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.

Affected Platforms (CPE)

📦

Vmware

Cloud Foundation

>= 3.0 and < 5.0

📦

Vmware

Vcenter Server

= 6.5= 6.7= 7.0

References & Advisories

🔗 http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.html

🔗 https://www.vmware.com/security/advisories/VMSA-2021-0020.html

🔗 http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.html

🔗 https://www.vmware.com/security/advisories/VMSA-2021-0020.html

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22005

Related Security Intelligence Articles

Daily Global Cyber Threat Intelligence Digest — July 21, 2026

Comprehensive breakdown of critical vulnerability advisories across VMware vCenter, F5 BIG-IP, and GitLab platforms, alongside threat actor reconnaissance trends and ransomware response strategies.

Related Vulnerabilities

CVE-2026-542496.8

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 t...

CVE-2026-466786.8

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an applic...

CVE-2026-5473510.0

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain ...

CVE-2026-119748.6

The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file rea...