CVE-2021-22010

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to create a denial of service condition due to excessive memory consumption by VPXD service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
n/aVMware vCenter Server, VMware Cloud FoundationVMware vCenter Server(7.x before 7.0 U2c and 6.7 before 6.7 U3o) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2)

References

Timeline

Published
Sep 23, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-220115.3vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious actor with network acceCVE-2021-220127.5The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. A malicious actor wiCVE-2021-220137.5The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. A malicioCVE-2021-220147.2The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). An authentiCVE-2021-220157.8The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An autCVE-2021-220166.1The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attacker may exploit thisCVE-2021-220175.3Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with netCVE-2021-220186.5The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A malicious actor with CVE-2021-220197.5The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with network access to port 5CVE-2021-22026.5Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.32 CVE-2021-220205.5The vCenter Server contains a denial-of-service vulnerability in the Analytics service. Successful exploitation of this issue may allow an aCVE-2021-220215.4VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An
CVE-2021-22010: High severity, CVSS 7.5 | Vulnix