# CVE-2021-21972: VMware vCenter Server Remote Code Execution Vulnerability

> CVE-2021-21972: VMware vCenter Server Remote Code Execution Vulnerability. CVSS 9.8 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2021-21972
Last updated: 2026-08-12T03:55:37Z

- Published: 2021-02-24 16:42 UTC · Updated: 2026-08-12 03:55 UTC · Assigner: vmware
- CVSS: 9.8 (CVSS 3.1) · Severity: Critical · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS: 99.9%, 100th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2021-11-03, federal due date 2021-11-17, ransomware use: Known

## Description

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

## CISA required action

Apply updates per vendor instructions.

## Affected vendors and products

- n/a: VMware Cloud Foundation
- n/a: VMware vCenter Server

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2021-21972)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2021-21972)
- [http://packetstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.html](http://packetstormsecurity.com/files/161590/VMware-vCenter-Server-7.0-Arbitrary-File-Upload.html)
- [http://packetstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.html](http://packetstormsecurity.com/files/161695/VMware-vCenter-Server-File-Upload-Remote-Code-Execution.html)
- [http://packetstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.html](http://packetstormsecurity.com/files/163268/VMware-vCenter-6.5-6.7-7.0-Remote-Code-Execution.html)
- [https://www.vmware.com/security/advisories/VMSA-2021-0002.html](https://www.vmware.com/security/advisories/VMSA-2021-0002.html)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2021-21972 · Markdown: https://rewindex.com/cve/CVE-2021-21972.md · JSON: https://rewindex.com/api/v1/cves/CVE-2021-21972 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:18.608Z