CVE-2021-21998

—

CVSS 3.1

9.8 critical

EPSS

11%p96

Published

Jun 23, 2021 (Jun 23, 2021)

Modified

Jun 17, 2026

Description

VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate.

Vendors: vmware
Products: carbon black app control
Weakness: CWE-287
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (10.6%)

In the news2 stories

VMware releases patches for critical flaw in Carbon Black App Control

Security AffairsJun 24, 16:57 UTC · Jun 24, 2021Vulnerability CVE-2021-21998

Critical Auth Bypass Bug Affects VMware Carbon Black App Control

The Hacker NewsJun 24, 08:00 UTC · Jun 24, 2021Vulnerability CVE-2021-21998 CVE-2021-21982 CVE-2021-21999