CVE Watch—

CVE-2021-21985

VMware vCenter Server Improper Input Validation Vulnerability

CVSS

—

No CVSS

EPSS

100.0%

p100

KEV

YES

Nov 3, 2021

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

100.0%EPSS · 30 days100.0%

2026-06-302026-07-16

KEV catalog record

Product

VMware / vCenter Server

Vulnerability

VMware vCenter Server Improper Input Validation Vulnerability

Added to KEV

Nov 3, 2021

Remediate by

Nov 17, 2021

Known ransomware use

Yes

Summary description

VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-21985

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2021-22005—

100.0%

KEV—80VMware vCenter Server File Upload Vulnerability—CVE-2021-21972—

99.9%

KEV—80VMware vCenter Server Remote Code Execution Vulnerability—CVE-2023-34048—

99.9%

KEV—80VMware vCenter Server Out-of-Bounds Write Vulnerability—CVE-2020-3952—

99.8%

KEV—80VMware vCenter Server Information Disclosure Vulnerability—CVE-2024-38812—

98.9%

KEV—80VMware vCenter Server Heap-Based Buffer Overflow Vulnerability—CVE-2021-22017—

98.7%

KEV—80VMware vCenter Server Improper Access Control—