What’s Vulnerable › Vulnerabilities

CVE-2021-21980

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-11-24 · updated 2026-06-17

Description

The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.

Affected products

• VMware Cloud Foundation: 3.0
• VMware vCenter Server: 6.5, 6.5-update_1, 6.5-update_1b, 6.5-update_1c, 6.5-update_1d, 6.5-update_1e (+29)
• VMware vCenter Server and VMware Cloud Foundation: VMware vCenter Server (6.7 before 6.7 U3p and 6.5 before 6.5 U3r) and VMware Cloud Foundation 3.x

References

• https://www.vmware.com/security/advisories/VMSA-2021-0027.html
• https://www.vmware.com/security/advisories/VMSA-2021-0027.html

Get alerted when CVE-2021-21980 or the next vulnerability affects your stack