What We Do
How We Do
Resources
Company
Partners
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Get Started
Security advisories

UPDATE: Critical VMware vCenter Vulnerability

September 28, 2021 | 1 MIN READ

Speak With A Security Expert Now

TALK TO AN EXPERT

THE THREAT

UPDATE: Exploitation of CVE-2021-22005 has been identified in the wild. Fully functional Proof-of-Concept (PoC) exploit code for CVE-2021-22005 was publicly released on September 27th. The release of PoC code is expected to result in widespread exploitation of the vulnerability in the immediate future. Organizations need to ensure that either the VMware security patches, or temporary mitigations are applied immediately to prevent exploitation.

On September 21st, VMware announced a critical vulnerability impacting VMware vCenter servers. The vulnerability is a file upload vulnerability tracked as CVE-2021-22005 (CVSS: 9.8). Exploitation would allow a threat actor to execute remote code on vulnerable systems by uploading a specially crafted malicious file. Previous authentication is not required for exploitation.

Organizations are strongly recommended to apply the relevant security patch as soon as possible.

What we’re doing about it

What you should do about it

Additional information

CVE-2021-22005 impacts vCenter Server 6.7 and 7.0. Exploitation requires that a vulnerable version of vCenter be accessible over port 443. CVE-2021-22005 is considered trivial to exploit and would provide significant access to threat actors; these factors increase the likelihood that threat actors will focus on this vulnerability and attempt to exploit it before organizations have widely deployed patches.

In addition to CVE-2021-22005, VMware addressed 18 other vulnerabilities. These vulnerabilities are not considered critical but should be addressed with the available security patches.

References:

[1] https://us-cert.cisa.gov/ncas/current-activity/2021/09/24/vmware-vcenter-server-vulnerability-cve-2021-22005-under-active
[2] https://blogs.vmware.com/vsphere/2021/09/vmsa-2021-0020-what-you-need-to-know.html
[3] https://kb.vmware.com/s/article/85717
[4] https://www.vmware.com/security/advisories/VMSA-2021-0020.html

View Most Recent Advisories