CVE-2021-21972

What it actually does

CVE-2021-21972 is an unauthenticated remote code execution vulnerability in a vCenter Server plugin exposed through the vSphere Client over HTTPS on port 443. An attacker with network reachability to the vCenter Server management interface can abuse a path traversal flaw to reach vulnerable plugin functionality and execute operating system commands with unrestricted privileges on the host running vCenter Server. Successful exploitation can provide full control of the vCenter management plane, including access to virtual infrastructure metadata, credentials, configuration, and administrative functions for managed ESXi hosts and virtual machines.

Why it matters to the business

This vulnerability can allow an external or internal attacker to take over vCenter Server, which is often the central control point for an organization’s virtualization environment. Compromise can lead to widespread disruption of virtual machines, theft of sensitive data, creation or deletion of infrastructure, credential theft, and ransomware deployment across large portions of the environment. Because this issue is listed in CISA KEV, has been exploited in the wild, has very high EPSS likelihood, and has been associated with ransomware activity, remediation should be treated as urgent for any exposed or unpatched vCenter Server or VMware Cloud Foundation deployment.

How an attack unfolds

An attacker first identifies an internet-facing or internally reachable vCenter Server with the vSphere Client service exposed on TCP port 443. They then send crafted HTTPS requests to vulnerable plugin endpoints in the vCenter Server appliance. The flaw allows traversal to unintended paths and interaction with plugin functionality in a way that results in command execution on the underlying operating system without authentication. After gaining code execution, the attacker commonly validates access with simple commands, writes a web shell or script to disk for persistence, enumerates vCenter configuration and credentials, and pivots to control managed virtualization resources. In real-world incidents, exploitation has been used as an initial access path for post-exploitation activity including privilege expansion, data theft, lateral movement, and ransomware deployment against virtualized workloads.

How to fix it

Upgrade affected VMware products to fixed or later versions immediately. VMware vCenter Server should be upgraded to 7.0 U1c or later for 7.x, 6.7 U3l or later for 6.7, and 6.5 U3n or later for 6.5. VMware Cloud Foundation should be upgraded to 4.2 or later for 4.x and 3.10.1.2 or later for 3.x. If immediate patching is not possible, apply VMware’s official workaround for disabling the vulnerable vCenter Server plugin, but treat this only as a temporary risk reduction measure. Restrict access to vCenter management interfaces to trusted administrative networks, VPNs, or bastion hosts; block public internet exposure of TCP 443 to vCenter; enforce strong administrative authentication; and review all vCenter accounts, roles, plugins, and appliances for signs of compromise before returning systems to normal operation.

How to confirm the fix worked

Confirm the installed vCenter Server or VMware Cloud Foundation version is at or above the fixed release for the deployed branch. Verify that the vulnerable plugin is no longer present or has been remediated according to VMware guidance, and that the vSphere Client functions normally after patching. Use authenticated vulnerability scanning or configuration assessment to confirm CVE-2021-21972 is no longer reported. Externally and internally validate that vCenter TCP port 443 is not reachable from untrusted networks. Review reverse proxy, vCenter, and appliance logs for historical requests to vulnerable plugin paths, unexpected command execution, suspicious files written under web-accessible directories, and newly created administrative users or unexpected changes to vCenter roles and permissions.

Typical attack path

1. Scan for VMware vCenter Server or VMware Cloud Foundation management interfaces exposed over HTTPS on TCP port 443.
2. Fingerprint the vSphere Client and plugin endpoints to determine whether the target is running a vulnerable vCenter version.
3. Send a crafted unauthenticated request abusing the vulnerable plugin path traversal and remote command execution behavior.
4. Execute operating system commands with high privileges on the vCenter Server host.
5. Deploy a web shell, script, or other payload to maintain access.
6. Enumerate vCenter configuration, credentials, certificates, SSO data, ESXi hosts, datastores, and virtual machines.
7. Use vCenter administrative control to move laterally, access virtual machines, disrupt services, or stage ransomware activity.

How to detect it

Review vCenter Server, vSphere Client, reverse proxy, and appliance system logs for unauthenticated requests to vulnerable plugin endpoints, especially requests containing directory traversal sequences or access to the vROps Client plugin upload endpoint. Key log sources include vCenter HTTPS access logs, vSphere Client logs, appliance syslog, shell command history, authentication logs, and file integrity monitoring for web directories. Look for HTTP POST requests to plugin paths from unfamiliar IP addresses, requests containing `..`, `%2e%2e`, or plugin resource traversal patterns, and suspicious files created under vCenter web application directories. Investigate signs of post-exploitation such as unexpected child processes spawned by vCenter services, shell commands executed by service accounts, newly created local or SSO users, modified vCenter roles, suspicious cron jobs, web shells, encoded command lines, outbound connections from the vCenter appliance, and ransomware staging behavior. Because exploitation has occurred in the wild and is associated with ransomware activity, historical logs around and after public disclosure should be reviewed, not only current alerts.

• /ui/vropspluginui/rest/services/uploadova
• POST /ui/vropspluginui/rest/services/uploadova
• /ui/vropspluginui/
• vropspluginui
• %2e%2e
• ../
• ..%2f
• ..%5c
• /usr/lib/vmware-vsphere-ui/server/work/deployer/s/global/
• /usr/lib/vmware-vsphere-ui/server/work/deployer/s/global/.jsp
• /usr/lib/vmware-vsphere-ui/server/work/deployer/s/global/*.jsp
• /usr/lib/vmware-vsphere-ui/server/work/deployer/s/global/*.jspx
• /usr/lib/vmware-vsphere-ui/server/work/deployer/s/global/*.war
• /usr/lib/vmware-vsphere-ui/server/work/deployer/s/global/*.sh
• /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log
• /var/log/vmware/vsphere-ui/logs/access/
• /var/log/vmware/vsphere-ui/logs/
• /var/log/vmware/envoy/envoy-access.log
• /var/log/vmware/vmon/vmon.log
• /var/log/audit/audit.log
• /var/log/messages
• /var/log/vmware/sso/
• cmd.exe
• /bin/bash
• /bin/sh
• wget
• curl
• chmod +x
• base64 -d
• nc -e
• ncat
• crontab -e

What your security team should do

• Treat this as a critical emergency remediation item for any vulnerable vCenter or VMware Cloud Foundation instance, especially if reachable from the internet or broad internal networks.
• Patch to the fixed VMware release for the active product branch; use the official plugin-disabling workaround only until patching can be completed.
• Immediately remove public internet exposure to vCenter management services and limit TCP 443 access to trusted administrative sources.
• Hunt for prior exploitation before and after patching, because successful exploitation may leave persistent web shells, new accounts, altered roles, or attacker tooling behind.
• Review vCenter SSO users, local appliance accounts, roles, permissions, plugins, scheduled tasks, and recent administrative actions for unauthorized changes.
• Rotate credentials and certificates that may have been accessible from the compromised vCenter appliance if exploitation is suspected.
• Increase monitoring for ransomware staging behavior, mass VM power operations, datastore enumeration, unusual file writes, and lateral movement from the vCenter appliance.
• Prioritize this vulnerability in vulnerability management reporting because it is CISA KEV-listed, actively exploited, has very high exploit probability, and is known to be used in ransomware campaigns.