CVE-2021-22005

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	VMware vCenter Server, VMware Cloud Foundation	VMware vCenter Server(7.x before 7.0 U2c and 6.7 before 6.7 U3o) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2)

References

http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.htmlExploit, Third Party Advisory, VDB Entry
https://www.vmware.com/security/advisories/VMSA-2021-0020.htmlPatch, Vendor Advisory
http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.htmlExploit, Third Party Advisory, VDB Entry
https://www.vmware.com/security/advisories/VMSA-2021-0020.htmlPatch, Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22005US Government Resource

Timeline

Published: Sep 23, 2021
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-220067.5The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicious actor with network CVE-2021-220075.5The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user with non-administra CVE-2021-220087.5The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor with network access to CVE-2021-220097.5The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor with network access CVE-2021-22014.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.23 an CVE-2021-220107.5The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter CVE-2021-220115.3vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious actor with network acce CVE-2021-220127.5The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor wi CVE-2021-220137.5The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicio CVE-2021-220147.2The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authenti CVE-2021-220157.8The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An aut CVE-2021-220166.1The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit this