CVE-2021-21972 VMware vCenter Server Remote Code Execution

Exploited in the wild Critical 9.8 Published 24 Feb 2021 Updated 12 Aug 2026

Attackers with network access can exploit a path traversal flaw in the vSphere Client to execute arbitrary commands with unrestricted privileges on the host.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-21972?

CVE-2021-21972 is a critical path traversal vulnerability in Vmware Cloud Foundation, published on 24 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Weakness: CWE-22

Which versions are affected by CVE-2021-21972?

It affects 2 products.

Products include Vmware Cloud Foundation, Vmware Vcenter Server.

How do I fix CVE-2021-21972?

No fix has been published for CVE-2021-21972 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Nov 2021.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-21972 being exploited?

Yes. Attackers have exploited CVE-2021-21972 in the wild since at least 3 Nov 2021, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 2 Exploit-DB entries, 1 Nuclei template and 27 proofs of concept on GitHub.

All Vmware Cloud Foundation vulnerabilities

Sources

Also known as GHSA-c9cr-34rr-8gpr.