CVE-2021-21972VulnerabilityPublished 11/03/2021Updated 10/24/2026
CVE-2021-21972: VMware vCenter Server Remote Code Execution Vulnerability
Affects VMware vCenter ServerSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 11/03/2021
- KEV deadline
- 11/17/2021
- Ransomware
- Used in ransomware campaigns
- EPSS
- 99.9% chance of exploitation in 30 days – higher than 99% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Description
CVE-2021-21972 is a remote code execution vulnerability in the VMware vCenter Server vSphere Client plugin. It allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.