BlackTreeCVE IntelligenceVMware · vCenter Server
CISA confirms exploitation in the wild and lists 2021-11-17 as the remediation due date.
CISA confirms exploitation in the wild and lists 2021-11-17 as the remediation due date.
Fix not verifiedVMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.
VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.
Attacker-controlled path data is not constrained to the intended directory before the application accesses a file.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may execute code or commands in the affected security context.
VMware vCenter Server vSphere Client contains a remote code execution vulnerability in a vCenter Server plugin which allows an attacker with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system.
Attacker-controlled path data is not constrained to the intended directory before the application accesses a file.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may execute code or commands in the affected security context.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
CISA added this CVE to its Known Exploited Vulnerabilities catalogue on 2021-11-03. Known ransomware campaign use is recorded.
A structured CVE source labels at least one public reference as exploit material. BlackTree has not independently validated that it is safe, reliable or weaponised.
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 24 Feb 2021 · Last source change 12 Aug 2026, 03:55 UTC · CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Core structured fields are present and their contributing authorities are shown above.