CVE-2021-21985: VMware vCenter Server Improper Input Validation Vulnerability
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
Other sources
VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-21985?
CVE-2021-21985 is a vulnerability in VMware vCenter Server that allows remote code execution.
How severe is CVE-2021-21985?
CVE-2021-21985 has a severity rating of 9.8, which is considered critical.
What is the affected software?
The affected software is VMware vCenter Server versions 6.5, 6.7, and 7.0, as well as VMware Cloud Foundation versions 3.0 to 4.2.1.
Is the Virtual SAN Health Check plug-in enabled by default?
Yes, the Virtual SAN Health Check plug-in is enabled by default in vCenter Server.
How can I fix CVE-2021-21985?
To fix CVE-2021-21985, apply the necessary patches provided by VMware and follow their recommended mitigation steps.