CVE-2021-22017
VMware vCenter Server Improper Access Control
Published Sep 23, 2021 · updated Jun 16, 2026 · vmware vcenter server
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
Timeline
Detection, updates, and resolution for this record.
Sep 23, 2021 · Catalog
Detected
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
Jan 10, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jan 24, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
Required action
Apply updates per vendor instructions.
CISA due date Jan 24, 2022
Affected
- cpe vmware/vcenter server6.7
- vendor VMware vCenter Serverversion unspecified
Sources
- CISA KEVCVE-2021-22017
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.
cisa.gov - CVE.orgCVE-2021-22017
Official CVE identifier
cve.org - FIRST EPSSCVE-2021-22017
30-day exploitation probability 49.2%
first.org - NIST NVDCVE-2021-22017
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.
nvd.nist.gov