IRONSMITHINTEL
MEDIUMCVSS5.3
|
Actively Exploited
|CISA KEV|CVE-2021-21973|Auth: none — unauthenticated|Reboot: required|Manual only

VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) Vulnerability

VMware vCenter Server and Cloud Foundation Server contain a SSRF vulnerability due to improper validation of URLs in a vCenter Server plugin. This allows for information disclosure.

Published Feb 24, 2021 · Updated May 16, 2026
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

A remote attacker, without authentication, can achieve partial data exposure. Federal agencies are required to remediate by 2022-03-21 under CISA BOD 22-01.

How the attack worksNo clicks needed

This is a Server-Side Request Forgery (SSRF) (CWE-918) vulnerability in VMware vCenter Server and Cloud Foundation. The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure. This affects: VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2). Exploitation requires remote network access, low attack complexity, no authentication required, and no user interaction required.

📧

Phishing link

→

🖼

Malicious file

🔓

Server compromised

Am I affected?Quick check

Probably yes if any of these apply:

●Virtualisation Administrators
●Infrastructure Team
●IT Security
●Running cloud foundation: 3.0 ≤ v < 3.10.1.2, 4.0 ≤ v < 4.2; vcenter server: 6.5, 6.7, 7.0
Real-world incidentsWhat we've seen

CISA added this CVE to the Known Exploited Vulnerabilities catalog on 2022-03-07 based on evidence of active exploitation in the wild. Federal agencies required to remediate by 2022-03-21.

How to patch

Manual remediation steps

Apply the Vendor Patch

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog — apply the vendor's security update as soon as possible.

CISA required action: Apply updates per vendor instructions.

References

    1
    Vendor advisory: https://www.vmware.com/security/advisories/VMSA-2021-0002.html
    1
    NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2021-21973
    1
    CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21973
PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2021-21973↗ NVD↗ Vendor Advisory