CVE-2021-21976

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-11 · updated 2026-06-17
Weakness: CWE-78

Description

vSphere Replication 8.3.x prior to 8.3.1.2, 8.2.x prior to 8.2.1.1, 8.1.x prior to 8.1.2.3 and 6.5.x prior to 6.5.1.5 contain a post-authentication command injection vulnerability which may allow an authenticated admin user to perform a remote code execution.

Affected products

vSphere Replication: from 6.5.0 before 6.5.1.5; from 8.1.0 before 8.1.2.3; from 8.2.0 before 8.2.1.1; from 8.3.0 before 8.3.1.2 — fixed in 6.5.1.5, 8.1.2.3, 8.2.1.1, 8.3.1.2
vSphere Replication: from vSphere Replication 8.3.x prior through 8.3.1.2, 8.2.x prior to 8.2.1.1, 8.1.x prior to 8.1.2.3 and 6.5.x prior to 6.5.1.5

How to fix

Upgrade to a fixed version: vSphere Replication 6.5.1.5, 8.1.2.3, 8.2.1.1, 8.3.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-21976 or the next vulnerability affects your stack