VMware vCenter Server vSAN Health Check Plugin Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2021-21985)
Executive & SecOps Summary
SECOPS ASSESSMENTVMware vCenter Server versions 6.5, 6.7, and 7.0 with the default-enabled Virtual SAN Health Check plug-in
An unauthenticated attacker with network access to port 443 can execute arbitrary commands with root privileges on the underlying operating system
Apply official security patches immediately, or disable the vulnerable vSAN Health Check plug-in as a temporary workaround
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade vCenter Server to a patched version. Use the following commands in the vCenter Server Appliance (VCSA) shell to check and install updates.
# Access the vCenter Appliance Shell and check the current version
software-packages list --current
# Stage and install the latest patches from the online repository
software-packages install --url --acceptEEULA2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, disable the vulnerable vSAN Health Check plug-in by modifying the compatibility matrix configuration.
# Access the VCSA bash shell
shell
# Backup the compatibility matrix configuration file
cp /etc/vmware/vsphere-client/compatibility-matrix.xml /etc/vmware/vsphere-client/compatibility-matrix.xml.bak
# Add the following entry inside the <plugins> section to block the plugin:
# <plugin id='com.vmware.vrops.installplugin' status='incompatible'/>
# Restart the vSphere Client service to apply changes
service-control --stop vsphere-ui
service-control --start vsphere-ui3. Log Audit & IoC Verification Commands
Audit the vSphere Client logs to detect unauthorized or suspicious API calls targeting the vropsplugin endpoint.
# Search for vropsplugin API requests and successful responses in the Virgo log
grep -i 'vropsplugin' /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log
# Scan for suspicious Java reflection or ProcessBuilder execution attempts
grep -E '(bean|processbuilder|runtime.getruntime)' /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.logDetect Container Escape & Privilege Escalation Across Your Kubernetes Fleet
Continuous eBPF-based runtime threat detection and posture management for AWS, GCP, Azure, Docker, and Kubernetes workloads.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-21985) exists in the HTML5-based vSphere Client of VMware vCenter Server due to a lack of input validation (CWE-20) and unsafe reflection (CWE-470) within the Virtual SAN (vSAN) Health Check plug-in. An attacker can bypass authentication and input validation mechanisms by sending crafted HTTP POST requests to internal API endpoints, allowing them to instantiate arbitrary Java classes and invoke methods.
2. Exploitation Mechanics & Attack Scenario
An attacker with network access to the HTTPS port (TCP 443) of vCenter Server sends a malicious JSON payload to specific REST API endpoints associated with the vSAN Health Check plug-in (e.g., /ui/vropsplugin/api/services/...). This payload triggers an internal reflection mechanism, allowing the attacker to instantiate arbitrary Java objects and execute OS-level commands with root privileges on the underlying Photon OS hosting the vCenter Server.
3. Infrastructure & Business Impact
vCenter Server acts as the centralized control plane for virtualized environments (ESXi hosts, VMs, and storage). With a CVSS score of 9.8, successful exploitation grants full administrative control over the entire virtualization infrastructure. This can lead to unauthorized VM manipulation, data exfiltration, ransomware deployment, and complete business disruption. This vulnerability has been actively exploited in the wild (CISA KEV listed).
Official Vendor Advisories & References
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
Frequently Asked SecOps Questions (CVE-2021-21985)
FAQQ1. How critical is CVE-2021-21985 and is it actively exploited in the wild?
CVE-2021-21985 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-21985?
Primary impacted vendors include vmware across vcenter_server, vsphere_client. Scope summary: VMware vCenter Server 7.0 (prior to 7.0 U2b), 6.7 (prior to 6.7 U3n), and 6.5 (prior to 6.5 U3p)
Q3. What temporary mitigations or workarounds exist for CVE-2021-21985 before patching?
[Mitigation] Apply official security patches immediately, or disable the vulnerable vSAN Health Check plug-in as a temporary workaround Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-21985
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (vmware)
View Category →VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
VMware ESX Insufficient Logging Vulnerability (CVE-2026-41709) - Audit Bypass and Admin Activity Concealment
[Affected Scope] VMware ESX hypervisor environments.
Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)
[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.