CVE-2021-22005 is a file upload vulnerability in VMware vCenter Server. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. VMware vCenter Server contains a file upload vulnerability in the Analytics service that allows a user with network access to port 443 to execute code.
What Makes This Vulnerability Dangerous in vCenter Server
CVE-2021-22005 is dangerous because it turns a reachable management service into a code execution path. In a platform like vCenter Server, that matters because compromise can extend well beyond one host, especially when the server is used to administer many virtualized assets and trust relationships.
The core security issue is that file upload flaws are often not just about storing a file, they are about getting attacker-controlled content into a privileged application path. When that content is processed by a service with broad administrative reach, the impact can move quickly from application compromise to infrastructure compromise.
How Organisations Check Exposure
Exposure review should start with a precise asset inventory of every vCenter Server instance, including test, standby and internet-facing deployments. Organisations should confirm whether port 443 is exposed, whether the Analytics service is reachable, and whether any reverse proxy, load balancer or external access path increases attack surface.
For this class of issue, the practical question is not only whether the product exists somewhere in the environment, but whether it is externally reachable and whether the vulnerable service is enabled. Vendor advisories and the NIST National Vulnerability Database should be used for version-specific validation, while the CVE Program remains the canonical record for the identifier itself.
When a vulnerability is in CISA’s KEV catalogue, exposure review should be treated as a priority exercise rather than a routine backlog item. That is especially true for management-plane software, where a single reachable instance can create disproportionate organisational risk.
Remediation and Compensating Controls
Patch or upgrade through the vendor’s guidance as soon as operationally possible, but do not wait for a maintenance window to reduce risk. If immediate remediation is not possible, constrain network access to the management interface, restrict who can reach port 443, and isolate the affected system behind tightly controlled administrative paths.
Compensating controls should focus on reducing opportunity for unauthorised upload and on shrinking the blast radius if exploitation occurs. That usually means limiting inbound access, monitoring the service for unexpected file writes or unusual process execution, and treating the system as high-value until it is confirmed clean.
For exploited management-plane flaws, vulnerability management is not just about tracking a ticket, it is about verifying exposure, prioritising remediation against real exploitation evidence, and confirming that compensating controls are actually reducing risk.
Detection and Post-Compromise Review
Detection should look for signs that a file upload was used as a staging step, followed by unexpected code execution, webshell placement, or unusual service behaviour. Because the vulnerable surface sits on a management plane, attackers may use initial access to move quickly into broader administrative activity.
After patching, organisations should review logs, filesystem changes, and administrator activity for evidence of pre-patch compromise. If there is any indication that the system was abused, the response should include credential review for administrative accounts, session invalidation where applicable, and investigation of adjacent systems that the vCenter instance could reach or manage.
Where a management server may have been compromised, the incident review must assume that attacker activity could extend beyond the original entry point. That includes checking for persistence, lateral movement, and any signs that the platform was used to pivot into other administrative or virtualized assets.
Risk and Threat Considerations
A file upload flaw in vCenter Server is especially risky because it can give an attacker a direct route from network access to code execution on a high-trust management system. That combination raises the stakes well beyond a typical web application bug, since compromise of the management plane can expose multiple downstream systems at once.
Failure mechanism: An attacker abuses the upload path to place or trigger attacker-controlled content in a privileged service context, then uses the resulting execution to gain deeper control of the management environment.
Impact: The likely outcome is loss of administrative integrity, potential pivoting into managed infrastructure, and a need to assume that credentials, sessions or adjacent administrative paths may also be at risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | vCenter file-upload exposure requires timely identification and verification of vulnerable assets |
| SC-7 — Boundary Protection | internet reachability to port 443 materially shapes exploit exposure for this management service | |
| SI-2 — Flaw Remediation | this CVE requires prompt remediation once exploitation risk is known | |
| Recommendation — Track exposed vCenter instances and verify vulnerability status against authoritative advisories. Restrict network paths to the management interface and reduce direct exposure. Apply vendor remediation quickly and confirm affected systems are updated. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | prioritising a KEV-listed vCenter flaw depends on continuous discovery and remediation tracking |
| Recommendation — Continuously inventory, prioritise, and remediate exposed vCenter systems. | ||
| OWASP ASVS | V5 — File Handling | the vulnerability is a file upload weakness, so file-handling assurance is directly relevant |
| Recommendation — Verify file upload handling, storage, and execution controls for management services. | ||
Practitioner Guidance
Why practitioners should care: Management-plane vulnerabilities need faster handling than ordinary application issues because the affected service often has outsized control over the rest of the environment. For vCenter Server, the operational question is not just whether the flaw exists, but whether the instance sits on a path that an attacker can realistically reach and exploit.
Common misunderstanding: Teams sometimes treat “no public UI change” as evidence of low risk. File upload vulnerabilities often live behind familiar interfaces, so the absence of obvious user-facing disruption does not mean the server is safe.
Practitioner takeaway: Treat every exposed management service as a high-value target until exposure, patch status, and compromise checks are all confirmed.
Related resources from NHI Mgmt Group
- CVE-2022-22948 (VMware vCenter Server Incorrect Default File Permissions Vulnerability)
- CVE-2021-21973 (VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF))
- CVE-2021-22017 (VMware vCenter Server Improper Access Control)
- CVE-2021-20022 (SonicWall Email Security Unrestricted Upload of File)