CVE-2021-21985
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input...
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
- Record
CVE-2021-21985- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-918, CWE-20, CWE-470
- Updated
- 2026-11-02
CVE List
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
- Record
CVE-2021-21985- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-470, CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2021-9156
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
- Record
EUVD-2021-9156- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rg6m-2r9v-c5fj
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input...
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
- Record
GHSA-rg6m-2r9v-c5fj- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-918
- Updated
- 2026-11-02
CISA KEV No score
VMware vCenter Server Improper Input Validation Vulnerability
VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.
- Record
CVE-2021-21985- Weakness
- CWE-20, CWE-470, CWE-918
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | VMware vCenter Server Virtual SAN Health Check Plugin RCE | 2021-05-25 |
| PoC in GitHub | bigbroke/CVE-2021-21985 | 2021-05-27 |
| PoC in GitHub | alt3kx/CVE-2021-21985_PoC | 2021-05-29 |
| PoC in GitHub | mauricelambert/CVE-2021-21985 | 2021-06-01 |
| PoC in GitHub | onSec-fr/CVE-2021-21985-Checker | 2021-06-01 |
| PoC in GitHub | xnianq/cve-2021-21985_exp | 2021-06-03 |
| PoC in GitHub | daedalus/CVE-2021-21985 | 2021-06-04 |
| PoC in GitHub | testanull/Project_CVE-2021-21985_PoC | 2021-06-05 |
| PoC in GitHub | haidv35/CVE-2021-21985 | 2021-07-08 |
| PoC in GitHub | aristosMiliaressis/CVE-2021-21985 | 2021-07-11 |
| PoC in GitHub | sknux/CVE-2021-21985_PoC | 2021-11-09 |
| Nuclei | VMware vSphere Client (HTML5) - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21985 is a critical vulnerability (CVSS 9.8) in Vmware Vcenter Server, published May 26, 2021. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.
References
vmware.com/security/advisories/VMSA-2021-0010.html
packetstormsecurity.com/files/162812/VMware-Security-Advisory-2021-0010.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21985
nvd.nist.gov/vuln/detail/CVE-2021-21985
github.com/advisories/GHSA-rg6m-2r9v-c5fj