CVE-2021-21983: vRealize Operations Manager API arbitrary file write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityAlthough it requires authentication and is rated medium by CVSS, the very high EPSS score and public exploit references raise the practical risk.

What it is

The vRealize Operations Manager API before 8.4 allows an authenticated actor with network access to write files to arbitrary locations on the underlying Photon OS. Because the write is unrestricted, it can be chained with other flaws to reach code execution, as the referenced exploit material suggests.

Impact

An attacker with valid credentials gains the ability to place files anywhere on the appliance filesystem, which can corrupt the system or be leveraged for code execution. The CVSS vector rates integrity and availability impact as high, with no confidentiality impact.

Attack surface

Reached over the network through the vRealize Operations Manager API; the vector requires high privileges (PR:H) and no user interaction. Authentication is required, so this is a post-authentication flaw rather than an unauthenticated one.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.686 (99.3rd percentile) and public exploit references exist, indicating active interest and likely weaponization.

What to do

• Upgrade vRealize Operations Manager to 8.4 or later per VMware advisory VMSA-2021-0004.
• Restrict network access to the vRealize Operations Manager API to trusted management networks.
• Audit and minimize accounts with API access; enforce least privilege and strong authentication.
• Monitor the appliance filesystem for unexpected file creation or modification, especially in executable paths.

Detection

• Alert on unexpected file writes or new files in system and web-accessible directories on the vRealize Operations Manager appliance.
• Monitor API logs for anomalous requests from authenticated accounts, particularly file-related endpoints.
• Correlate API activity with subsequent process execution or service restarts on the Photon OS host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.