CVE Watch12 ago 2026

CVE-2021-21985

VMware vCenter Server Improper Input Validation Vulnerability

CVSS

9.8

Crítico

EPSS

100.0%

p100

KEV

SÍ

3 nov 2021

Exploit Today

0-100

Publicado: 26 may 2021 · Última mod.: 12 ago 2026 · CWE-918 · CWE-20 · CWE-470

EPSS · 30d

100.0%EPSS · 30 días100.0%

2026-09-162026-10-14

Ficha del catálogo KEV

Producto

VMware / vCenter Server

Vulnerabilidad

VMware vCenter Server Improper Input Validation Vulnerability

Añadido a KEV

3 nov 2021

Remediar antes de

17 nov 2021

Uso conocido en ransomware

Sí

Descripción resumida

VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health Check plug-in, which is enabled by default in vCenter Server, which allows for remote code execution.

Acción requerida

Apply updates per vendor instructions.

Notas

https://nvd.nist.gov/vuln/detail/CVE-2021-21985

Descripción técnica

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-798218.2 ALT

—

———A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down.6h CVE-2026-37127.3 ALT

—

———The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.8h CVE-2026-766617.6 ALT

—

———A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.11h CVE-2026-766608.7 ALT

—

———A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.11h CVE-2026-1108705.3 MED

—

——0Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal characters reach envelope.to and RCPT TO, causing rejected delivery or parser interpretation conflicts that bypass domain allow-lists.14h CVE-2026-1108688.5 ALT

—

——0Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.14h