9.8Kritisch KEV In Ransomware genutzt

CVE-2021-22005VMware vCenter Server File Upload Vulnerability

VMware vCenter Server, VMware Cloud Foundation Veröffentlicht: 2021-09-23 14:37 (vor 5 Jahren)

Bekannt ausgenutzt — VMware vCenter Server File Upload Vulnerability

CISA hat am 03.11.2021 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 17.11.2021.

Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2021-22005

Beschreibung

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.

Schwachstellentyp (CWE): CWE-22

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
—	VMware vCenter Server, VMware Cloud Foundation	VMware vCenter Server(7.x before 7.0 U2c and 6.7 before 6.7 U3o) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2)
vmware	cloud foundation	3.0 – < 5.0
vmware	vcenter server	6.5

Referenzen und Patches

https://www.vmware.com/security/advisories/VMSA-2021-0020.html PatchVendor Advisory
http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.html ExploitThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22005 US Government Resource

CPE-Treffer (NVD) (4)

cpe:2.3:a:vmware:cloud_foundation:*:*:*:*:*:*:*:* ≥ 3.0 < 5.0
cpe:2.3:a:vmware:vcenter_server:6.5:-:*:*:*:*:*:*
cpe:2.3:a:vmware:vcenter_server:6.7:-:*:*:*:*:*:*
cpe:2.3:a:vmware:vcenter_server:7.0:-:*:*:*:*:*:*

CVSS-Score

9.8Kritisch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Alle Scores (4)

CISA-ADP	CVSS 3.1	9.8Kritisch
nvd	CVSS 3.1	9.8Kritisch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Kritisch
nvd	CVSS 2.0	7.5Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

100.00%

höher als 100 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: active
Automatisierbar: yes
Technische Auswirkung: total

Zeitverlauf

ID reserviert2021-01-04
Veröffentlicht2021-09-23 14:37
Bei IP-DB eingegangen2026-10-24 23:35
In KEV aufgenommen2021-11-03
Zuletzt aktualisiert2026-06-17 06:36

Vergeben von (CNA): vmware
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — VMware ESXi / vCenter

2.7Niedrig

CVE-2026-41709 KEV vor 3 Monaten

ESX insufficient logging vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware ESX; VMware Telco Cloud Platform

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

7.6Hoch

CVE-2026-41703 vor 3 Monaten

Out-of-bounds read vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware ESX; VMware Workstation

VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condit…

9.3Kritisch

CVE-2026-47876 vor 3 Monaten

VMXNET3 out-of-bounds write vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware ESX; VMware Telco Cloud Platform

VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the hos…

9.8Kritisch

CVE-2026-59309 vor 3 Monaten

vCenter authentication-bypass vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware vCenter; VMware Telco Cloud Infrastructure

VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.

9.8Kritisch

CVE-2026-59310 KEV In Ransomware genutzt vor 3 Monaten

vCenter directory-traversal vulnerability

VMware Cloud Foundation; VMware vSphere Foundation; VMware vCenter; VMware Telco Cloud Infrastructure

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

62%EPSS

8.0Hoch

CVE-2026-41724 vor 5 Monaten

VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)

VMware VCF operations; VMware VMware Aria Operations; VMware VMware Telco Cloud Platform

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create policies, views or text-widgets may be able to inject scripts to perform administrative actions in VMware Cloud Founda…