ZeroDay Findings
Sign inSign up

Findings

CVE-2021-21985

VMware vCenter Server Improper Input Validation Vulnerability

Published May 26, 2021 · updated Aug 11, 2026 · vmware vcenter server

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

Timeline

Detection, updates, and resolution for this record.

  1. May 26, 2021 · Catalog

    Detected

    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Nov 17, 2021 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Aug 11, 2026 · Catalog

    Updated

    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

Required action

Apply updates per vendor instructions.

CISA due date Nov 17, 2021

Affected

  • cpe vmware/cloud foundationversion unspecified
  • cpe vmware/vcenter server6.5
  • vendor VMware vCenter Serverversion unspecified

Sources

  • CISA KEVCVE-2021-21985

    VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.

    cisa.gov
  • CVE.orgCVE-2021-21985

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-21985

    30-day exploitation probability 100.0%

    first.org
  • Metasploit Modulesexploit_linux/http/vmware_vcenter_vsan_health_rce

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2021-21985

    The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute com

    nvd.nist.gov

References

CVE-2021-21985 · ZeroDay Findings