CVE-2021-22005
9.8CRITICALThe vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code
Published: 9/23/2021Updated: 10/30/2025
CISA Known Exploited Vulnerability
VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
Required Action:
Apply updates per vendor instructions.
Due Date:
2021-11-17
Known Ransomware Use
Description
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
AI AnalysisPowered by AI
Affected Products
vmwarecloud_foundation
vmwarevcenter_server
6.5
vmwarevcenter_server
6.7
vmwarevcenter_server
7.0
References
- http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.htmlExploitThird Party AdvisoryVDB Entry
- https://www.vmware.com/security/advisories/VMSA-2021-0020.htmlPatchVendor Advisory
- http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.htmlExploitThird Party AdvisoryVDB Entry
- https://www.vmware.com/security/advisories/VMSA-2021-0020.htmlPatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22005US Government Resource