The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.
Is CVE-2021-22005 exploited?
Listed in the CISA KEV catalog on 2021-11-03.
Federal remediation due 2021-11-17.
Past that date by 1808 days.
Used in ransomware campaigns.
EPSS puts exploitation in the next 30 days at 100.0%.
Public exploit code: packaged in a public tool.
Public detection rules exist.
Which products and versions are affected?
VMware vCenter Server, VMware Cloud Foundation · VMware vCenter Server(7.x before 7.0 U2c and 6.7 before 6.7 U3o) and VMware Cloud Foundation (4.x before 4.3 and 3.x before 3.10.2.2)
Is there a patch?
Patch information is not available in this record.