What’s Vulnerable › Vulnerabilities

CVE-2021-22048

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 10.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-11-10 · updated 2026-06-17

Description

The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group.

Affected products

• VMware Cloud Foundation: from 3.0 through 3.10.2.2; from 4.0 through 4.1.0.1
• VMware vCenter Server: 6.5, 6.7, 7.0
• VMware vCenter Server and VMware Cloud Foundation: VMware vCenter Server(7.0 and 6.7) and VMware Cloud Foundation (4.x and 3.x)

References

• http://packetstormsecurity.com/files/167733/VMware-Security-Advisory-2022-0025.2.html
• http://packetstormsecurity.com/files/167795/VMware-Security-Advisory-2021-0025.3.html
• https://www.vmware.com/security/advisories/VMSA-2021-0025.html
• http://packetstormsecurity.com/files/167733/VMware-Security-Advisory-2022-0025.2.html
• http://packetstormsecurity.com/files/167795/VMware-Security-Advisory-2021-0025.3.html
• https://www.vmware.com/security/advisories/VMSA-2021-0025.html

Get alerted when CVE-2021-22048 or the next vulnerability affects your stack