High‑Severity SSRF in VMware vRealize Operations Manager API (CVE‑2021‑21975) Undermines Credential Protection
What It Is
A Server‑Side Request Forgery (SSRF) flaw exists in the vRealize Operations Manager (vROps) API for versions prior to 8.4. An attacker who can reach the API over the network can craft requests that cause the server to issue arbitrary HTTP calls to internal services, potentially harvesting administrative credentials stored or transmitted within the vROps environment.
Exploitability
- Public proof‑of‑concept code has been released.
- CVSS v3.1 base score 8.8 (High).
- Listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild or a high likelihood thereof.
Affected Products
- VMware vRealize Operations Manager API (all releases before 8.4).
Why It Matters for Compliance & Audit Readiness
The vulnerability directly challenges access‑control and vendor‑management assurances that many frameworks (e.g., NIST CSF PR.AC‑1, ISO 27001 A.9) require organizations to demonstrate. If an attacker extracts admin credentials, the trust relationship with the vendor is compromised and the organization may lose evidence of due‑diligent control monitoring. Mapping this issue to your control‑assurance program helps:
- Document a control gap – the API was exposed without sufficient network segmentation.
- Generate defensible evidence – patch status, network‑segmentation diagrams, and log‑review artifacts can be presented during audits.
- Maintain continuous monitoring – by integrating API‑access logs into a SIEM, you create an audit trail that proves ongoing oversight of privileged‑access pathways.
Recommended Actions
- Patch immediately to vRealize Operations Manager 8.4 or later, or apply any vendor‑issued interim fix.
- Restrict network exposure: place the API behind a firewall or zero‑trust segment, allowing only authorized management hosts.
- Enable strict outbound request controls on the vROps appliance to block unexpected internal calls.
- Log and monitor all API calls and outbound HTTP requests; alert on anomalies that target internal IP ranges.
- Update your vendor‑risk register to reflect the SSRF risk and record remediation evidence for audit purposes.
Source: CISA KEV – CVE‑2021‑21975