CVE-2021-21974: VMware ESXi OpenSLP heap overflow, mass-exploited by ESXiArgs
The short version: CVE-2021-21974 is a heap-overflow vulnerability in the OpenSLP service (port 427) used by VMware ESXi. An attacker with network access to that port can trigger it to run code on the hypervisor itself. It's old and patched, but it became famous in early 2023 as the entry point for the ESXiArgs ransomware campaign that mass-encrypted unpatched, internet-reachable ESXi hosts. If you still expose OpenSLP, this is patch-or-disable, today. Steady hands — but close the port.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | 8.8 — High · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 45.06% · 98.64th percentile (2026-07-17) |
| In CISA KEV? | No — not listed in the catalog |
| Known exploited? | Yes — the ESXiArgs ransomware campaign (early 2023) exploited unpatched OpenSLP at scale |
| Vulnerability type | CWE-787 out-of-bounds write (heap overflow) in OpenSLP → remote code execution on the hypervisor |
| Requires authenticated session? | No — pre-authentication, but requires network access to port 427 |
| Affected | ESXi 7.0 before ESXi70U1c-17325551 · 6.7 before ESXi670-202102401-SG · 6.5 before ESXi650-202102101-SG |
| Fixed in | The patched builds above (or disable the SLP service) |
What you need to know
OpenSLP is a service-discovery daemon that ESXi historically ran on TCP/UDP port 427. CVE-2021-21974 is a heap overflow in how it parses SLP messages: a crafted request corrupts memory and yields code execution on the ESXi host — the layer that runs every virtual machine on that server.
Two things shape the real-world risk:
- The scoring vector is "Adjacent" (AV:A), not fully remote. An attacker needs to reach port 427 — same network segment, or an ESXi host whose SLP port is exposed to the internet. That's a narrower path than a pure internet-wide bug, and it's why the practical urgency hinges on whether OpenSLP is reachable at all.
- It was weaponized anyway. In February 2023, the ESXiArgs ransomware campaign swept up thousands of ESXi hosts that were both unpatched and exposing OpenSLP, encrypting virtual-machine files directly on the hypervisor. The theoretical became operational at scale.
How serious we see it
High — in practice, driven by exposure rather than the raw CVSS band.
The 8.8 is fair on paper. What pushes our real-world take is the target and the track record: code execution on a hypervisor reaches every VM it hosts, and this specific flaw already fueled a mass-ransomware event. The bounded, reassuring part is that it's narrow and closable two ways — the patches have been out for years, and VMware's long-standing guidance is to disable the SLP service where it isn't needed, which removes the exposure without a version dependency. Confirming whether port 427 is even reachable answers most of the question.
Recommendations
Straight from VMware's advisory (VMSA-2021-0002) and the ESXiArgs response guidance:
- Patch now. Update ESXi to the fixed builds — ESXi70U1c-17325551 / ESXi670-202102401-SG / ESXi650-202102101-SG or later.
- Disable OpenSLP if you don't need it. VMware recommends disabling the SLP service on ESXi hosts that don't require it — this closes the exposure regardless of build.
- Get port 427 off the internet. ESXi management and SLP should never be internet-facing; restrict them to trusted management networks.
- If compromised, respond. ESXiArgs left recovery paths in some cases, but treat an exploited host as compromised — isolate, restore VMs from clean backups, and investigate.
- Confirm your exposure first. Verify whether any ESXi host exposes OpenSLP (port 427), and which build you're running.
How BreachRisk sees it
BreachRisk works from the outside in, the way an attacker does. From little more than your domain it discovers internet-facing ESXi hosts and exposed management/OpenSLP surfaces, fingerprints the ESXi build, and flags exposure tied to this known-exploited flaw — including the exposed port 427 that ESXiArgs depended on. We detect and prioritize the exposure; we don't exploit the memory-corruption bug.
The value of a continuous, attacker's-eye view is exactly this: an ESXi host that shouldn't be reachable from the internet — and the SLP port that shouldn't be open — surface as findings before they become someone's ransomware foothold.