CVE-2021-26987

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-15 · updated 2026-06-17

Description

Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCenter Server, Management Services versions prior to 2.17.56 and Management Node versions through 12.2 contain vulnerable versions of SpringBoot Framework.

Affected products

NetApp, Inc. Element Plug-in for vCenter Server: all versions
NetApp Management Services For Element Software And Netapp Hci: before 2.17.56 — fixed in 2.17.56
NetApp Solidfire & Hci Management Node: through 12.2
Spring Boot: before 1.3.2 — fixed in 1.3.2
Element Plug-in for vCenter Server: all versions
Management Services for Element Software and NetApp HCI: versions prior to 2.17.56
NetApp SolidFire & HCI Management Node: versions through 12.2

How to fix

Upgrade to a fixed version: NetApp Management Services For Element Software And Netapp Hci 2.17.56; Spring Boot 1.3.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-26987 or the next vulnerability affects your stack