{"id":"CVE-2021-22005","published":"2021-09-23T12:15:07Z","modified":"2026-06-17T03:36:32Z","title":"VMware vCenter Server File Upload Vulnerability","vendor":"VMware","product":"vCenter Server","tier":"core","eol":null,"description":{"text":"The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.","provenance":"source","from":"NVD"},"summary":{"text":"The vulnerability is an arbitrary file upload flaw in the Analytics service of VMware vCenter Server. An attacker with network access to port 443 on the vCenter Server can exploit it, without authentication or user interaction, by uploading a specially crafted file to execute code on the server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:35Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99999,"percentile":0.99997,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-22005","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-09-24","exploitedFirstSeen":"2021-09-24","ransomware":true,"evidence":[{"url":"https://cisa.gov/news-events/alerts/2021/09/24/vmware-vcenter-server-vulnerability-cve-2021-22005-under-active","date":"2021-09-24"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://www.tenable.com/blog/contileaks-chats-reveal-over-30-vulnerabilities-used-by-conti-ransomware-affiliates","date":"2022-03-24"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/RansomwareUpdate%20Report%202022%20Q1.pdf","date":"2022-04-12"},{"url":"https://www.securin.io/articles/all-about-conti-ransomware/","date":"2022-06-29"},{"url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-279a","date":"2022-10-06"},{"url":"https://unit42.paloaltonetworks.com/network-security-trends-nov-jan/","date":"2023-05-02"},{"url":"https://25491742.fs1.hubspotusercontent-eu1.net/hubfs/25491742/WAZAWAKA_TLPCLEAR_Report.pdf","date":"2023-12-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2021-22005","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2021-22005","date":"2024-01-23"}],"evidenceTotal":634,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-23","name":"Relative Path Traversal"}],"references":[{"url":"http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0020.html","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0020.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22005","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Unrestricted File Upload","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited by an adversary who can access the vCenter Server over the network. The adversary uploads a crafted file to the server's analytics service via port 443, exploiting the file upload vulnerability. This results in remote code execution on the host. Threat actors have been observed leveraging this vulnerability, identified as CVE-2021-22005, using code released by security researcher Jang, to gain unauthorized access to vCenter servers.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Unrestricted File Upload","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited by an adversary who can access the vCenter Server over the network. The adversary uploads a crafted file to the server's analytics service via port 443, exploiting the file upload vulnerability. This results in remote code execution on the host. Threat actors have been observed leveraging this vulnerability, identified as CVE-2021-22005, using code released by security researcher Jang, to gain unauthorized access to vCenter servers.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-9174","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9174","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":12,"skipped":0,"earliest":"2021-09-23","earliestUrl":"https://github.com/1ZRR4H/CVE-2021-22005","repos":[{"name":"shmilylty/cve-2021-22005-exp","url":"https://github.com/shmilylty/cve-2021-22005-exp","stars":193,"created":"2021-12-18"},{"name":"rwincey/CVE-2021-22005","url":"https://github.com/rwincey/CVE-2021-22005","stars":37,"created":"2021-09-28"},{"name":"TaroballzChen/CVE-2021-22005-metasploit","url":"https://github.com/TaroballzChen/CVE-2021-22005-metasploit","stars":22,"created":"2021-10-02"},{"name":"Jun-5heng/CVE-2021-22005","url":"https://github.com/Jun-5heng/CVE-2021-22005","stars":21,"created":"2021-10-27"},{"name":"5gstudent/CVE-2021-22005-","url":"https://github.com/5gstudent/CVE-2021-22005-","stars":13,"created":"2021-09-25"}]},"metasploit":[{"name":"VMware vCenter Server Analytics (CEIP) Service File Upload","module":"exploit/linux/http/vmware_vcenter_analytics_file_upload","type":"exploit","disclosureDate":"2021-09-21","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_vcenter_analytics_file_upload.rb"}],"nuclei":[{"id":"CVE-2021-22005","name":"VMware vCenter Server - Arbitrary File Upload","severity":"critical","path":"http/cves/2021/CVE-2021-22005.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22005.yaml"}],"first":{"date":"2021-09-21","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_vcenter_analytics_file_upload.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"VMware vCenter Server File Upload CVE-2021-22005","id":"b014ea07-8ea0-4859-b517-50a4e5b7ecec","level":"high","status":"test","path":"rules-emerging-threats/2021/Exploits/CVE-2021-22005/web_cve_2021_22005_vmware_file_upload.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-22005/web_cve_2021_22005_vmware_file_upload.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/164439/VMware-vCenter-Server-Analytics-CEIP-Service-File-Upload.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2021-09-21","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2021-09-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vmware_vcenter_analytics_file_upload.rb","provenance":"source"},{"date":"2021-09-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22005","provenance":"source"},{"date":"2021-09-24","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cisa.gov/news-events/alerts/2021/09/24/vmware-vcenter-server-vulnerability-cve-2021-22005-under-active","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9174","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":41},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1863 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 1.0000"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 12 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}