CVE-2021-21985 in vCenter Server
Summary
by MITRE • 05/26/2021
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability identified as CVE-2021-21985 represents a critical remote code execution flaw within VMware's vSphere Client interface, specifically affecting the Virtual SAN Health Check plug-in that operates through the HTML5 client. This vulnerability exists within the vCenter Server environment where the plug-in is enabled by default, creating an attack surface that malicious actors can exploit without requiring authentication credentials. The flaw stems from insufficient input validation mechanisms that fail to properly sanitize user-supplied data passed to the Virtual SAN Health Check functionality, allowing attackers to inject malicious payloads that can execute with the highest privileges available on the host operating system.
The technical exploitation of this vulnerability occurs through network-based attacks targeting port 443, which is the standard HTTPS port used for secure communication with vCenter Server. Attackers can craft specially formatted requests that bypass input validation controls within the Virtual SAN Health Check plug-in, ultimately leading to arbitrary code execution on the underlying operating system. This privilege escalation occurs because the plug-in executes with elevated permissions typically reserved for system-level operations, meaning successful exploitation grants attackers complete control over the vCenter Server host. The vulnerability affects multiple versions of VMware vCenter Server and the associated Virtual SAN Health Check functionality, making it particularly dangerous as organizations with default configurations are immediately at risk.
The operational impact of CVE-2021-21985 extends far beyond simple system compromise, as it provides attackers with unrestricted access to the entire vCenter Server infrastructure and all managed virtual environments. This includes access to sensitive data, virtual machine configurations, and the ability to manipulate or exfiltrate information from the entire virtualized environment. The default enablement of the vulnerable plug-in means that organizations without proactive security measures are immediately vulnerable, creating a significant risk for enterprise environments that rely on vCenter Server for managing large-scale virtual infrastructures. Organizations may face complete loss of virtualization control, potential data breaches, and disruption of critical business operations due to unauthorized access to their virtualized environments.
Organizations should implement immediate mitigations including disabling the vulnerable Virtual SAN Health Check plug-in through vCenter Server configuration settings, applying VMware's official patches and updates released in response to this vulnerability, and implementing network segmentation to restrict access to port 443. Security teams must also conduct comprehensive vulnerability assessments to identify any potential exploitation attempts and monitor network traffic for suspicious activity targeting the affected port and functionality. The vulnerability aligns with CWE-20, which describes improper input validation, and represents a significant risk under ATT&CK framework category T1059 for execution techniques. Additional protective measures include implementing network-based firewalls, conducting regular security audits, and ensuring that all VMware products are maintained with the latest security patches to prevent similar vulnerabilities from being exploited in the future.