CVE-2021-1499: Cisco HyperFlex HX Data Platform unauthenticated file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote file upload with public exploit code and very high EPSS, though not in KEV and rated MEDIUM by CVSS.

What it is

The web-based management interface of Cisco HyperFlex HX Data Platform lacks authentication on its file upload function, allowing a remote attacker to upload files without credentials. Because uploaded files land with the permissions of the tomcat8 user, the flaw can be chained toward remote code execution, making it more serious than its MEDIUM base score suggests.

Impact

An attacker can write arbitrary files to the affected device as the tomcat8 user, which can lead to code execution or full compromise of the management interface depending on what is uploaded.

Attack surface

Reachable over the network through the web-based management interface via a crafted HTTP request; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.80426, 99.6th percentile) and a public Packet Storm exploit reference exists, indicating active interest and available exploit code.

What to do

• Apply the Cisco security advisory (cisco-sa-hyperflex-upload-KtCK8Ugz) patch or fixed release for HyperFlex HX Data Platform.
• Restrict network access to the HyperFlex management interface to trusted administrative networks only.
• Disable or block external exposure of the web management interface until patching is complete.
• Monitor and audit the tomcat8 user's file directories for unexpected uploaded content.
• Review Cisco advisory for any additional workarounds specific to the affected deployment.

Detection

• Inspect HTTP request logs to the HyperFlex management interface for upload requests lacking authentication or with unusual multipart payloads.
• Monitor file system changes in tomcat8-owned directories for new or modified files.
• Alert on unexpected processes or scripts spawned under the tomcat8 service account.
• Correlate network traffic to the management interface from untrusted source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.