CVE-2021-22017VulnerabilityPublished 01/10/2022Updated 10/24/2026

CVE-2021-22017: VMware vCenter Server Improper Access Control

Affects VMware vCenter ServerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 01/10/2022
KEV deadline: 01/24/2022
EPSS: 49.2% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-22017 (opens in a new tab)

Description

CVE-2021-22017 is a high-severity vulnerability in VMware vCenter Server involving improper access control due to flawed URI normalization in the rhttproxy component. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

Summary

The vulnerability identified as CVE-2021-22017 affects VMware vCenter Server's rhttproxy component, where improper implementation of URI normalization leads to improper access control. This flaw can allow unauthorized access or actions due to bypassing intended access restrictions. The vulnerability is classified under CWE-23 (Relative Path Traversal). It has been reported as exploited in the wild, indicating active threat usage. However, no details on affected versions or remediation status are provided in the input data.

Impact

Exploitation of this vulnerability can lead to unauthorized access or actions within the vCenter Server environment due to improper access control. Given that it has been exploited in the wild, it poses a significant risk to affected systems. The exact impact depends on the environment and attacker capabilities but is considered high severity.

Mitigation

Patch status is not yet confirmed — check the VMware vendor advisory for current remediation guidance. Until an official fix is available, monitor vendor communications closely and apply any recommended temporary mitigations if provided.

Weaknesses

CWE-23Relative Path Traversal (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:56:53 UTC

Weaknesses

References

Related threats