Actively exploited in the wild
VMware vCenter Server Improper Input Validation Vulnerability
VMware - vCenter Server · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-21985
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
Risk Assessment
An attacker can gain full control of the vCenter server, leading to compromise of confidentiality, integrity, and availability of the entire virtual infrastructure.
Recommendation
Apply available patches from VMware for vCenter Server and disable the Virtual SAN Health Check plug-in if not in use.
Original NVD description (English source)
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.