CVE-2021-21975VulnerabilityPublished 01/18/2022Updated 10/24/2026

CVE-2021-21975: VMware Server Side Request Forgery in vRealize Operations Manager API

Affects VMware vRealize Operations Manager APISource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 01/18/2022
KEV deadline: 02/01/2022
Ransomware: Used in ransomware campaigns
EPSS: 78.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-21975 (opens in a new tab)

Description

CVE-2021-21975 is a Server Side Request Forgery (SSRF) vulnerability in VMware vRealize Operations Manager API versions prior to 8.4. This flaw allows an attacker with network access to the API to perform SSRF attacks that can lead to theft of administrative credentials. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns.

Summary

This vulnerability (CVE-2021-21975) affects VMware vRealize Operations Manager API versions before 8.4. It is a Server Side Request Forgery (SSRF) issue where a malicious actor with network access to the API can abuse the SSRF flaw to steal administrative credentials. The vulnerability is known to be exploited in the wild and has been linked to ransomware campaigns. No explicit patch or remediation details are provided in the source data.

Impact

An attacker exploiting this SSRF vulnerability can steal administrative credentials from the vRealize Operations Manager, potentially leading to unauthorized administrative access and control over the affected system. The vulnerability has been exploited in the wild and is associated with ransomware campaigns, indicating a significant risk to affected environments.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor VMware advisories closely and apply any available updates for vRealize Operations Manager API, especially upgrading to version 8.4 or later if possible.

Weaknesses

CWE-918Server-Side Request Forgery (SSRF) (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:57:10 UTC

Weaknesses

References

Related threats