Critical Remote Code Execution in VMware vCenter Server (CVE‑2021‑21972) Threatens Virtualized Environments
What It Is — A remote code execution (RCE) flaw in the vSphere Client plugin of VMware vCenter Server allows an unauthenticated network attacker on TCP 443 to run arbitrary commands with unrestricted operating‑system privileges.
Exploitability — Publicly disclosed; proof‑of‑concept code is available and the vulnerability scores 9.8 (CVSS v3.1) – Critical. No known active exploit‑as‑a‑service, but the attack surface is trivial for any reachable vCenter instance.
Affected Products — VMware vCenter Server (all supported versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Continuous control monitoring of patch management provides auditable evidence that critical vulnerabilities are remediated promptly, satisfying a core control objective across SOC 2, ISO 27001, NIST CSF and others.
- Mapping the patched state to a configuration baseline creates a defensible audit trail, helping enterprises demonstrate due‑diligence to regulators and customers.
- Visibility into network‑level access (port 443) reinforces access‑control monitoring, a prerequisite for detecting anomalous remote activity before it can be leveraged.
Recommended Actions
- Deploy VMware’s security patch for vCenter Server without delay.
- Restrict inbound traffic to port 443 to trusted management subnets or VPNs.
- Update your control‑mapping inventory to record the patch status and capture evidence (e.g., patch‑install logs, configuration scans) for audit readiness.
Source: CISA KEV – CVE‑2021‑21972