CVE-2021-21998

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A malicious actor with network access to the VMware Carbon Black App Control management server might be able to obtain administrative access to the product without the need to authenticate.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	VMware Carbon Black App Control (AppC)	VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2

References

https://www.vmware.com/security/advisories/VMSA-2021-0012.html?Patch, Vendor Advisory
https://www.vmware.com/security/advisories/VMSA-2021-0012.html?Patch, Vendor Advisory

Timeline

Published: Jun 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-219997.8VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior CVE-2021-22009.1Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Home page). The supported version that is CVE-2021-220007.8VMware Thinapp version 5.x prior to 5.2.10 contain a DLL hijacking vulnerability due to insecure loading of DLLs. A malicious actor with non CVE-2021-220017.5In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request o CVE-2021-220029.8VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 CVE-2021-220037.5VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network acc CVE-2021-220046.4An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf CVE-2021-220059.8The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 4 CVE-2021-220067.5The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicious actor with network CVE-2021-220075.5The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administra CVE-2021-220087.5The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to CVE-2021-220097.5The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access