CVE-2021-21973: VMware vCenter Server plugin SSRF allows information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is network-reachable without authentication and is listed in CISA KEV with very high EPSS, though its CVSS impact is limited to low confidentiality loss.

What it is

The vSphere Client (HTML5) in vCenter Server fails to properly validate URLs in a vCenter Server plugin, creating a server-side request forgery flaw. An attacker with network access to port 443 can send a crafted POST request to the plugin and cause the server to make requests on their behalf, leading to information disclosure. It affects vCenter Server 7.x before 7.0 U1c, 6.7 before 6.7 U3l, 6.5 before 6.5 U3n, and Cloud Foundation 4.x before 4.2 and 3.x before 3.10.1.2.

Impact

An attacker gains disclosure of information reachable by the vCenter server, which can expose internal services and data not otherwise accessible from outside. The CVSS vector rates confidentiality impact as low with no integrity or availability impact.

Attack surface

Reachable over the network via port 443 by sending a POST request to a vCenter Server plugin; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-07 with a 2022-03-21 remediation due date, and EPSS gives a 30-day exploitation probability of 0.8764 (99.75th percentile), indicating active exploitation is expected. No ransomware campaign use is documented.

What to do

• Apply the vendor updates in VMware advisory VMSA-2021-0002: vCenter Server 7.0 U1c, 6.7 U3l, 6.5 U3n, and Cloud Foundation 4.2 / 3.10.1.2 or later.
• If immediate patching is not possible, restrict network access to vCenter Server port 443 to trusted management networks only.
• Place vCenter Server behind management-plane segmentation and do not expose it directly to the internet.
• Monitor and alert on unexpected outbound requests originating from the vCenter Server host.

Detection

• Review vCenter Server and plugin logs for anomalous POST requests to plugin endpoints, especially those containing URL parameters.
• Monitor vCenter host outbound network traffic for connections to internal or unexpected destinations that do not match normal management traffic.
• Hunt for requests to vCenter plugin paths from untrusted source IPs or outside normal administrative windows.
• Correlate vCenter access logs with outbound connection logs to identify SSRF-style request chains.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.