VMware vCenter Server vSphere Client SSRF Vulnerability (CVE-2021-21973) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTVMware vCenter Server 7.0, 6.7, 6.5 and VMware Cloud Foundation 4.x, 3.x
Unauthenticated attackers with network access to port 443 can trigger SSRF to disclose sensitive internal information
Apply official security patches immediately or implement workarounds by disabling the vulnerable plugin
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade to the patched versions of vCenter Server. For vCenter Server Appliance (VCSA), you can apply the patch using the following CLI commands:
# Access the VCSA shell and install the patch from an attached ISO
software-packages install --iso --acceptEulas2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to port 443 using firewall rules to ensure only trusted administrative IPs can access the vCenter Server. Below is an example using iptables:
# Allow port 443 access only from a trusted admin IP (e.g., 192.168.1.100) and drop others
iptables -A INPUT -p tcp -s 192.168.1.100 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP3. Log Audit & IoC Verification Commands
Inspect the vSphere Client logs to identify potential exploitation attempts or unauthorized plugin requests. Use the following commands to check the version and scan logs for suspicious loopback requests:
# Check the current vCenter Server version
cat /etc/vmware/.vami_vcentertags
# Scan vSphere Client logs for suspicious POST requests targeting internal loopback addresses
grep -i 'POST' /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log | grep -E 'localhost|127.0.0.1'Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-21973) is a Server-Side Request Forgery (SSRF) vulnerability in the HTML5-based vSphere Client of VMware vCenter Server. It is caused by improper validation of URLs within a vCenter Server plugin, allowing arbitrary HTTP requests to be initiated from the server.
2. Exploitation Mechanics & Attack Scenario
A malicious actor with network access to port 443 can exploit this vulnerability without any authentication. By sending a crafted HTTP POST request to the vulnerable plugin endpoint, the attacker forces the vCenter Server to send requests to internal systems or loopback interfaces (127.0.0.1). This allows the attacker to perform internal port scanning, bypass firewall restrictions, and access internal management APIs to extract sensitive data.
3. Infrastructure & Business Impact
Since vCenter Server acts as the central management console for virtualized infrastructure, an SSRF vulnerability poses a severe threat. Attackers can leverage this to map internal networks and facilitate lateral movement. This vulnerability is listed in the CISA KEV catalog and has a high EPSS score (0.88+), indicating active exploitation in the wild.
Official Vendor Advisories & References
The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
Frequently Asked SecOps Questions (CVE-2021-21973)
FAQQ1. How critical is CVE-2021-21973 and is it actively exploited in the wild?
CVE-2021-21973 is rated CVSS 5.3 (MEDIUM) with a 30-day EPSS exploitation probability of 88.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-21973?
Primary impacted vendors include vmware across vcenter_server, cloud_foundation. Scope summary: VMware vCenter Server 7.0 (prior to 7.0 U1c), 6.7 (prior to 6.7 U3l), 6.5 (prior to 6.5 U3n) and VMware Cloud Foundation 4.x (prior to 4.2), 3.x (prior to 3.10.1.2)
Q3. What temporary mitigations or workarounds exist for CVE-2021-21973 before patching?
[Mitigation] Apply official security patches immediately or implement workarounds by disabling the vulnerable plugin Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-21973
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (vmware)
View Category →VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)
[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).
VMware Aria Operations Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-22719)
[Affected Scope] VMware Aria Operations instances with support-assisted product migration in progress
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.