CVE-2021-22005: VMware vCenter Server File Upload Vulnerability

CVE-2021-22005 is a file upload vulnerability in VMware vCenter Server’s Analytics service. An attacker who can reach the service over the network on port 443 can abuse it to execute code on the system. Because vCenter is the central management plane for many VMware environments, successful exploitation can give an attacker broad control over virtual infrastructure. The flaw has been used by ransomware operators, so timely response matters.

How it works

The weakness is classified as CWE-23 (relative path traversal). In this case it appears in the Analytics service of vCenter Server. A user with network access to port 443 can upload a crafted file in a way that bypasses intended path restrictions. Once the file is placed where the service will process it, the attacker can achieve code execution on the vCenter host. Exact request formats and payload details are not required for defenders; the essential point is that unauthenticated or lightly authenticated network access to the Analytics endpoint on 443 is sufficient to trigger the issue. Confirm the precise attack surface and any authentication requirements against the vendor advisory.

Am I affected? How to find it in your systems

VMware vCenter Server is typically deployed as a virtual appliance or Windows installation that manages ESXi hosts, clusters, and related services. It commonly listens on HTTPS (port 443) and is reachable from management networks, jump hosts, or, in poorly segmented environments, broader internal or even external networks.

• Inventory every vCenter Server instance: check CMDB records, hypervisor inventories, certificate or banner scans for “vCenter” or VMware management endpoints, and network device configs that reference port 443 management traffic.
• Record the exact product edition and build/version string from the vCenter UI, appliance shell, or vendor support tools. Compare those values to the fixed versions listed in the official VMware advisory for CVE-2021-22005; do not rely on generic version ranges.
• Determine whether the Analytics service is enabled and reachable on 443 from untrusted networks. Review firewall and load-balancer rules that expose the management interface.
• For signs of exploitation, examine web-access and application logs for unusual POST or file-upload activity directed at Analytics-related paths, unexpected new files under service directories, anomalous child processes spawned by the vCenter services, or outbound connections initiated shortly after such activity. Correlate with any EDR or hypervisor-level telemetry. Absence of obvious logs does not prove the system is clean; treat internet-exposed or ransomware-targeted instances as higher priority for forensic review.

How to remediate

The primary action is to apply the updates published by VMware for this vulnerability, following the vendor’s instructions exactly. CISA’s required action is the same: apply updates per vendor instructions. After patching, verify the new build number and confirm the Analytics service is running the remediated code. Reboot or restart services only as directed by the advisory. Once the patch is confirmed, review accounts, roles, and any recently created or modified objects for signs of prior compromise. Harden the management plane by restricting port 443 access to authorized administrative networks only and by disabling any unused services that the advisory or VMware hardening guides identify as unnecessary.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls:

• Network segmentation: block or tightly restrict inbound access to vCenter port 443 from anything except a small set of jump hosts or management subnets. Remove any internet-facing exposure immediately.
• Virtual patching / WAF: if a web application firewall or reverse proxy sits in front of vCenter, apply rules that block anomalous file-upload requests or path-traversal patterns aimed at the Analytics service. Treat these as temporary; they are not a substitute for the official patch.
• Feature disablement: if operationally feasible and supported by VMware documentation, disable the Analytics service until it can be patched.
• Heightened monitoring: alert on any new file writes under vCenter service directories, unexpected process execution, or authentication anomalies. Retain logs and consider taking a forensic snapshot before making further changes if compromise is suspected.

These steps lower risk but do not eliminate it; schedule the official update as soon as possible.

If your data may have been exposed

Actively exploited vulnerabilities, especially those known to be used by ransomware groups, frequently lead to full environment compromise and data theft or encryption. If your vCenter instances were reachable on port 443 and unpatched during the period of known exploitation, assume potential exposure of credentials, virtual-machine data, and connected infrastructure. Rotate privileged credentials, review backup integrity, and investigate lateral movement. As an additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether associated accounts have appeared in prior incidents.