VMware vRealize Operations Manager API Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-21975) Analysis and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTVMware vRealize Operations Manager API prior to version 8.4
Unauthenticated network-adjacent or remote attackers can perform SSRF attacks to steal administrative credentials and compromise internal infrastructure
Apply official security patches immediately or implement temporary API endpoint access restrictions
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade VMware vRealize Operations Manager to version 8.4 or later as recommended in VMSA-2021-0004.
# Log in to the Admin UI to upload and apply the official PAK upgrade file.
# Verify the cluster status and patch level via CLI:
su - admin -c 'casa-security-cli.sh --status'2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, modify the Nginx configuration to block external access to the vulnerable Casa API endpoint.
# Edit /usr/lib/vmware-vcops/user/conf/nginx/nginx-casa-proxy.conf
# Add the following block to deny access to the vulnerable endpoint:
location /casa/nodes/thumbprints {
deny all;
return 403;
}3. Log Audit & IoC Verification Commands
Scan the system logs to identify potential exploitation attempts targeting the vulnerable API endpoint.
# Search for suspicious requests to the thumbprints endpoint in the Casa log file
grep -i 'thumbprints' /usr/lib/vmware-vcops/user/log/casa.log | grep -E '200|500'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-21975) is a Server-Side Request Forgery (SSRF, CWE-918) in the VMware vRealize Operations Manager API. Due to insufficient input validation on specific API endpoints, a malicious actor with network access can force the server to make arbitrary HTTP requests to internal or external destinations.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker sends a crafted HTTP request to the vulnerable Casa API endpoint. The server processes this request and forwards it to internal loopback services or restricted management ports. This allows the attacker to bypass perimeter defenses, access local-only services, and extract sensitive administrative credentials, which can be chained with other vulnerabilities for remote code execution (RCE).
3. Infrastructure & Business Impact
With a CVSS score of 7.5 (High) and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses a severe threat. Successful exploitation can lead to complete administrative compromise of the vRealize Operations Manager, allowing attackers to control virtualized infrastructure, exfiltrate sensitive data, and disrupt business operations.
Official Vendor Advisories & References
Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
Frequently Asked SecOps Questions (CVE-2021-21975)
FAQQ1. How critical is CVE-2021-21975 and is it actively exploited in the wild?
CVE-2021-21975 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 78.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-21975?
Primary impacted vendors include vmware across vrealize_operations_manager. Scope summary: All VMware vRealize Operations Manager versions prior to 8.4 (both Cloud and On-Premises deployments)
Q3. What temporary mitigations or workarounds exist for CVE-2021-21975 before patching?
[Mitigation] Apply official security patches immediately or implement temporary API endpoint access restrictions Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-21975
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (vmware)
View Category →VMware Aria Operations Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-22719)
[Affected Scope] VMware Aria Operations instances with support-assisted product migration in progress
Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)
[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).
VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.