VMware vCenter Server vSphere Client Remote Code Execution (RCE) Vulnerability Advisory (CVE-2021-21972)
Executive & SecOps Summary
SECOPS ASSESSMENTVMware vCenter Server versions 7.0, 6.7, 6.5 and VMware Cloud Foundation versions 4.x, 3.x
Unauthenticated remote attackers with network access to port 443 can execute arbitrary commands with unrestricted privileges on the underlying operating system
Immediately upgrade to the patched versions or apply the official workaround to disable the vulnerable plugin
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is upgrading vCenter Server to a non-vulnerable version. Use the VCSA management interface or CLI to apply the update.
# Upgrade vCenter Server Appliance (VCSA) via CLI
# 1. Log in to the VCSA as root via SSH.
# 2. Check and install the latest software update packages.
software-packages install --url --acceptEulas
# 3. Restart the vSphere Client service to apply changes.
service-control --stop vsphere-ui
service-control --start vsphere-ui2. Temporary Workaround & Hardening Configuration
If patching cannot be performed immediately, disable the vulnerable vRealize Operations plugin to mitigate the attack vector.
# Workaround for Linux-based vCenter Server Appliance (VCSA)
# 1. Access the vCenter Server via SSH and enter the bash shell.
shell
# 2. Navigate to the plugin directory and rename the vulnerable plugin folder.
cd /etc/vmware/vsphere-ui/vc-packages/vsphere-client-serenity/
if [ -d 'com.vmware.vrops.install-6.x.x' ]; then
mv com.vmware.vrops.install-6.x.x com.vmware.vrops.install-6.x.x.backup
echo 'Plugin successfully disabled.'
fi
# 3. Restart the vsphere-ui service to apply the workaround.
service-control --stop vsphere-ui && service-control --start vsphere-ui3. Log Audit & IoC Verification Commands
Inspect web server logs and critical directories to identify potential exploitation attempts.
# 1. Search for exploitation attempts targeting the uploadova endpoint
grep -i 'uploadova' /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log
# 2. Inspect the root SSH authorized_keys file for unauthorized keys
cat /root/.ssh/authorized_keys
# 3. Verify the current vCenter Server version
com.vmware.appliance.version.getBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the vSphere Client (HTML5) within a default-installed vCenter Server plugin (specifically the vRealize Operations vCenter Adapter and its uploadova endpoint). Due to insufficient input validation of uploaded files, the application is susceptible to a Path Traversal (CWE-22) vulnerability. This architectural flaw allows unauthenticated remote attackers to write or overwrite arbitrary files on the local file system.
2. Exploitation Mechanics & Attack Scenario
An attacker initiates the exploit by sending a specially crafted tar archive via an HTTP POST request to the /ui/vropsplugin/vropsplugin/uploadova endpoint over port 443. By embedding path traversal sequences (e.g., ../../) within the archive, the attacker forces the server to extract files outside the intended directory. This allows the creation of a web shell in the web root or the injection of an SSH public key into the /root/.ssh/authorized_keys file, leading to unauthorized remote command execution with root privileges.
3. Infrastructure & Business Impact
vCenter Server acts as the centralized management plane for virtualized enterprise infrastructures. With a CVSS score of 9.8, successful exploitation of this vulnerability grants full control over the vCenter Server, allowing attackers to compromise all managed ESXi hosts and virtual machines. This can lead to catastrophic business disruption, data exfiltration, and ransomware deployment. Active exploitation in the wild (CISA KEV) underscores the critical urgency of remediation.
Official Vendor Advisories & References
The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Frequently Asked SecOps Questions (CVE-2021-21972)
FAQQ1. How critical is CVE-2021-21972 and is it actively exploited in the wild?
CVE-2021-21972 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-21972?
Primary impacted vendors include vmware across vcenter_server, cloud_foundation. Scope summary: VMware vCenter Server (7.0 before 7.0 U1c, 6.7 before 6.7 U3l, and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2)
Q3. What temporary mitigations or workarounds exist for CVE-2021-21972 before patching?
[Mitigation] Immediately upgrade to the patched versions or apply the official workaround to disable the vulnerable plugin Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-21972
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (vmware)
View Category →VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
VMware Aria Operations Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-22719)
[Affected Scope] VMware Aria Operations instances with support-assisted product migration in progress
Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)
[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.