VMware vCenter Server < 7.0 — RCE
A pre-authenticated remote code execution vulnerability in the vCenter Server vSAN Health Check plugin. Patch to vCenter 7.0 Update 2b / 6.7 Update 3n / 6.5 Update 3p — exploited in the wild for ransomware delivery.
Full unauthenticated code execution on the vCenter Server host. Since vCenter manages all ESXi hosts in the datacenter, compromise of vCenter equals compromise of every VM running in the environment. Attackers used this to deploy ransomware across all VMs simultaneously.
The vSAN Health Check plugin (enabled by default in vCenter Server) contains a remote code execution vulnerability. An attacker with network access to port 443 on vCenter can exploit this without any authentication. The plugin runs with the privileges of the vCenter service, which on Windows hosts runs as SYSTEM.
📧
Phishing link
🖼
Malicious file
🔓
Server compromised
Probably yes if any of these apply:
Affected OS versions
Following the May 2021 disclosure, multiple ransomware groups began mass-scanning for vulnerable vCenter instances. HelloKitty, BlackMatter, and Darkside ransomware operators exploited CVE-2021-21985 to encrypt virtual machine disk files (VMDKs) directly on the datastore, bypassing guest OS protections. An incident at a European logistics firm resulted in 2,000+ VMs encrypted within 4 hours.
Manual remediation steps
⏱ 2 hours including vCenter restartCheck Current vCenter Version
# From vCenter Appliance Shell (VCSA) or Windows vCenter:
shell
vmware -v
# Or check the vSphere Web Client: Help > About
Immediate Mitigation — Disable Affected Plugins
# If vCenter is on a Windows host, edit extensions config:
# 1. SSH to vCenter
# 2. Navigate to /etc/vmware/vsphere-ui/vc-packages/vsphere-client-serenity/
# 3. Rename or remove the vSAN health check plugin directory
# NOTE: Apply the patch ASAP — this workaround is not officially supported
Apply the vCenter Patch
# Mount and apply via Appliance Management (port 5480)
# https://<vcenter-ip>:5480 > Update > Check Updates
software-packages stage --iso --acceptEulas
software-packages install --staged
Verify
vmware -v
# Must show build 17958471 or later
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
References