CVE-2021-21980

HIGH 7.5CVE-2021-21980 · Published 24/11/2021 · updated 17/06/2026

In short

CVE-2021-21980 is a HIGH (CVSS 7.5) vulnerability affecting cloud foundation (vmware), vcenter server (vmware).
Chance of exploitation in the next 30 days (EPSS): 4.7%, higher than 91.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
cloud foundation vmware	`= 3.0`	No fix yet
vcenter server vmware	`= 6.5= 6.7`	No fix yet

Description

The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to gain access to sensitive information.

References

vmware.com/security/advisories/VMSA-2021-0027.html · Patch

More vulnerabilities in cloud foundation

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

cloud foundation

vmware

= 3.0

No fix yet

vcenter server

vmware

= 6.5= 6.7

No fix yet

More vulnerabilities in cloud foundation

See all →