CVE-2021-22005

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A...

9.8 CriticalIn KEVPublic exploit

CVE-2021-22005 is a critical vulnerability (CVSS 9.8) in Vmware Vcenter Server, published September 23, 2021. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. No source names a fixed version.

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

100.0%Up 99.3 points since Sep 24, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2021-22005
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-22
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2021-22005
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2021-9174 9.8

Record: EUVD-2021-9174
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9w75-994h-2j26 9.8

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A...

Record: GHSA-9w75-994h-2j26
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22, CWE-434
Updated: 2026-11-02

CISA KEV No score

VMware vCenter Server File Upload Vulnerability

VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.

Record: CVE-2021-22005
Weakness: CWE-23
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	VMware vCenter Server Analytics (CEIP) Service File Upload	2021-09-21
PoC in GitHub	1ZRR4H/CVE-2021-22005	2021-09-23
PoC in GitHub	pisut4152/Sigma-Rule-for-CVE-2021-22005-scanning-activity	2021-09-23
PoC in GitHub	Jeromeyoung/VMWare-CVE-Check	2021-09-24
PoC in GitHub	5gstudent/CVE-2021-22005-	2021-09-25
PoC in GitHub	RedTeamExp/CVE-2021-22005_PoC	2021-09-27
PoC in GitHub	rwincey/CVE-2021-22005	2021-09-28
PoC in GitHub	TaroballzChen/CVE-2021-22005-metasploit	2021-10-02
PoC in GitHub	tiagob0b/CVE-2021-22005	2021-10-24
PoC in GitHub	Jun-5heng/CVE-2021-22005	2021-10-27

Show 4 moreShow less

Public exploits
Source	Link	Date
PoC in GitHub	shmilylty/cve-2021-22005-exp	2021-12-18
PoC in GitHub	timb-machine-mirrors/testanull-CVE-2021-22005.py	2022-01-05
PoC in GitHub	InventorMAO/cve-2021-22005	2022-06-21
Nuclei	VMware vCenter Server - Arbitrary File Upload

History

History
When	Changed	Sources
2026-11-03	exploitation, exploits
2026-11-02	created	CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub