CVE-2021-21978: VMware View Planner logupload arbitrary file upload leads to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit references, and near-maximum EPSS make this an urgent exposure despite the absence of KEV listing.

What it is

VMware View Planner 4.x before 4.6 Security Patch 1 contains a remote code execution flaw in the logupload web application caused by improper input validation and missing authorization. An unauthenticated network attacker can upload and execute a crafted file, which matters because it gives code execution inside the logupload container with no credentials required.

Impact

An attacker gains remote code execution within the logupload container, with high confidentiality, integrity and availability impact per the CVSS vector. This can be used to run arbitrary code on the exposed service without prior access.

Attack surface

Reached over the network via the View Planner Harness logupload web application; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are needed. Any network-reachable instance of the affected component is exposed.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.99005, 99.9th percentile) and public references are tagged Exploit, indicating working exploit code is publicly available. No ransomware usage is documented in the record.

What to do

• Apply VMware View Planner 4.6 Security Patch 1 or later, per VMSA-2021-0003.
• If patching cannot be done immediately, restrict network access to the View Planner Harness and logupload service to trusted hosts only.
• Place the logupload component behind authentication or a reverse proxy that enforces access control.
• Monitor and, where feasible, disable the logupload functionality until the patch is applied.
• Review the logupload container for unauthorized files or processes after exposure.

Detection

• Inspect logupload upload directories and container filesystems for unexpected or recently written files, especially executable content.
• Alert on POST requests to logupload endpoints from untrusted source IPs or with unusual multipart payloads.
• Monitor the logupload container for unexpected child processes, shells or outbound connections.
• Correlate web access logs for the logupload application with process execution telemetry on the container host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.