CVE-2021-21972: VMware vCenter unauthenticated RCE via vSphere Client plugin
The short version: VMware vCenter Server has a remote code execution flaw (CVE-2021-21972) in a vSphere Client plugin that ships enabled by default. Any attacker who can reach port 443 can upload a file and execute commands with unrestricted privileges on the host — no authentication. It was mass-exploited soon after disclosure and is in CISA's KEV catalog. If your vCenter is reachable and unpatched, this is patch-and-verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 99.57% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2021-11-17 |
| Known exploited? | Yes — mass exploitation shortly after disclosure; CISA notes known ransomware use |
| Vulnerability type | CWE-22 path traversal / arbitrary file upload → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | vCenter Server 7.x < 7.0 U1c, 6.7 < 6.7 U3l, 6.5 < 6.5 U3n; Cloud Foundation 4.x < 4.2, 3.x < 3.10.1.2 |
| Fixed in | vCenter Server 7.0 U1c · 6.7 U3l · 6.5 U3n (and matching Cloud Foundation releases) |
What you need to know
CVE-2021-21972 lives in the vRealize Operations vCenter plugin (vropspluginui), which is present in default vCenter installations whether or not you use vRealize Operations. The plugin exposes an endpoint that accepts file uploads without authentication. An attacker who can reach vCenter over port 443 uploads a crafted file to a chosen location and gets command execution with unrestricted privileges on the underlying host.
Why it's about as bad as external exposure gets:
- vCenter is the keys to the virtual kingdom. It manages your ESXi hosts and virtual machines; code execution there reaches the whole virtual estate.
- It's pre-auth and reachable by design. Anyone with network access to port 443 can exploit it — no credential, no chain.
- It was mass-exploited. Scanning and exploitation began within a day of the advisory, and CISA notes known ransomware use.
How serious we see it
Critical — in practice and on paper.
Unauthenticated, network-reachable, privileged code execution on the platform that runs your virtual infrastructure, mass-exploited and in KEV, is the definition of top-of-queue. The 9.8 is not hyperbole. The bounded, reassuring part is that it's specific and fixable: particular vCenter and Cloud Foundation builds, published fixes, and a documented interim workaround (setting the plugin to incompatible — note that simply disabling it in the UI does not protect you). The catch is the same as any mass-exploited flaw — patched and clean are separate questions.
Recommendations
Straight from VMware's advisory (VMSA-2021-0002) and CISA:
- Patch now. Upgrade to vCenter Server 7.0 U1c / 6.7 U3l / 6.5 U3n or later.
- If you can't patch immediately, apply VMware's workaround. Set the affected plugin to incompatible per the advisory (disabling it in the UI is not sufficient).
- Hunt for prior use. Review logs for unexpected uploads to the plugin endpoint and signs of code execution on the host.
- If you find indicators, respond fully. Rebuild where warranted and rotate credentials, keys, and certificates.
- Get vCenter off the public internet. Restrict management access to trusted networks.
How BreachRisk sees it
BreachRisk discovers internet-facing vCenter Server instances from little more than your domain, fingerprints the product and version, and flags exposure tied to CVE-2021-21972 — raised to the top because it's in KEV and tied to ransomware. Where authorized, it goes a step past a scanner: it sends a safe, bounded check to the affected plugin endpoint and looks only for the response that indicates the vulnerable path is present, confirming exposure without uploading a payload or running code.
That outside-in, continuous view is the point: when a vCenter RCE breaks, the exposed appliance is already mapped, so you go straight to patch-and-verify.