VMware addresses a critical RCE issue in vCenter Server

CVE-2021-21972 is a remote code execution vulnerability in a plugin of the vSphere Client in VMware vCenter Server, underpinned by a path traversal flaw (CWE-23) in the plugin's file-upload functionality. It is triggered over the network through port 443: an attacker who can reach the vCenter web interface can submit crafted file-upload requests, traverse to arbitrary filesystem paths, and plant executable files on the underlying operating system. Successful exploitation yields unrestricted privileges on the vCenter host OS, giving attackers control of the central management platform for an organization's entire VMware vSphere virtualized estate. Any organization running an affected vCenter Server release whose port 443 is reachable from untrusted networks is exposed. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use and a 99.9% EPSS score (100th percentile), indicating active, widespread exploitation in the wild, though no public PoC is recorded in this data.

Do: Apply the vCenter Server updates published in VMware's advisory for CVE-2021-21972 as soon as possible, prioritizing internet-facing or partner-reachable vCenter instances. Until patched, restrict access to vCenter on port 443 to trusted management networks and review access logs for unauthenticated file-upload activity against the vSphere Client upload endpoint. Because ransomware operators have actively exploited this bug, hunt for signs of compromise such as webshells or unexpected new local accounts on vCenter appliances.

CVE-2021-21973 is a server-side request forgery (SSRF, CWE-918) in the vSphere Client (HTML5), caused by improper validation of URLs in a vCenter Server plugin. An unauthenticated attacker with network access to TCP port 443 can trigger it by sending a crafted POST request to the affected vCenter Server plugin, causing vCenter to make attacker-influenced internal requests. The direct impact is information disclosure (confidentiality only, CVSS 3.1 base 5.3), but SSRF in vCenter is frequently chained with other vCenter flaws to reach remote code execution, as reflected in the related advisories. Everyone running VMware vCenter Server 7.x/6.7/6.5 or VMware Cloud Foundation 4.x/3.x before the fixed releases is affected. The flaw is actively exploited: it is listed in CISA KEV (added 2022-03-07) and carries a very high EPSS (87.6%), with reporting of coordinated SSRF exploitation campaigns involving hundreds of source IPs.

Do: Upgrade vCenter Server to 7.0 U1c, 6.7 U3l, or 6.5 U3n, and Cloud Foundation to 4.2 or 3.10.1.2, per VMware's instructions. Until patched, restrict access to vCenter's port 443 from untrusted networks and review access logs for suspicious unauthenticated POST requests to the vSphere Client plugin endpoints. Given the KEV listing and reports of coordinated SSRF exploitation, treat patching as urgent even though this flaw alone yields information disclosure.

OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution.