CVE-2021-21985VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-21985: VMware vCenter Server Improper Input Validation Vulnerability

Affects VMware vCenter ServerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 11/17/2021
Ransomware: Used in ransomware campaigns
EPSS: 100.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-21985 (opens in a new tab)

Description

CVE-2021-21985 is a high-severity vulnerability in VMware vCenter Server's vSphere Client, specifically in the Virtual SAN Health Check plug-in enabled by default. It involves improper input validation that allows remote code execution. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.

Summary

VMware vCenter Server contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default. This flaw allows an attacker to execute remote code on the affected system. The vulnerability is identified as CVE-2021-21985 and has been actively exploited in the wild, including use in ransomware campaigns. The vulnerability relates to weaknesses categorized under CWE-20 (Improper Input Validation), CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), and CWE-918 (Server-Side Request Forgery).

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the vCenter Server, potentially leading to full system compromise. This can enable attackers to disrupt operations, steal sensitive data, or deploy ransomware. The vulnerability has been confirmed to be exploited in the wild, increasing the risk to affected organizations.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects an on-premises product and is actively exploited, organizations should monitor VMware's official advisories for patches or workarounds. Until a patch is applied, consider disabling the Virtual SAN Health Check plug-in if feasible or restricting network access to the vCenter Server to trusted administrators only.

CVE-2021-21985: VMware vCenter Server Improper Input Validation Vulnerability

What to do

Description

Summary

Impact

Mitigation

Weaknesses

References

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:42:51 UTC

Weaknesses

References

Related threats