CVE-2021-22025

—

CVSS 3.1

7.5 high

EPSS

<1%p55

Published

Aug 30, 2021 (Aug 30, 2021)

Modified

Jun 17, 2026

Description

The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. An unauthenticated malicious actor with network access to the vRealize Operations Manager API can add new nodes to existing vROps cluster.

Vendors: vmware
Products: cloud foundation, vrealize operations manager, vrealize suite lifecycle manager
Weakness: CWE-287
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news2 stories

VMware addressed 4 High

Security AffairsAug 26, 07:07 UTC · Aug 26, 2021Vulnerability CVE-2021-22025 CVE-2021-22024 CVE-2021-22026+2 CVEs

VMware Issues Patches to Fix New Flaws Affecting Multiple Products

The Hacker NewsAug 26, 07:50 UTC · Aug 26, 2021Vulnerability CVE-2021-22022 CVE-2021-22027 CVE-2021-22023+5 CVEs