CVE-2021-21985: VMware vCenter Server Remote Code Execution Vulnerability
What It Is — VMware vSphere Client’s Virtual SAN Health Check plug‑in (enabled by default) fails to properly validate input, allowing an unauthenticated attacker to execute arbitrary code on the vCenter Server host.
Exploitability — Publicly disclosed; proof‑of‑concept code exists; CVSS 3.1 base score 9.8 (Critical).
Affected Products — VMware vCenter Server (vSphere Client) with the Virtual SAN Health Check plug‑in enabled.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management evidence: timely detection, patching, and proof of remediation are core audit artifacts.
- Highlights the importance of configuration control (disabling unnecessary default components) as part of a defensible change‑management process.
- Provides a concrete test of the VCF control objective “Identify, assess, and remediate vulnerabilities,” which maps to many frameworks (e.g., NIST CSF Identify, ISO 27001 A.12.6).
Recommended Actions
- Apply VMware’s security patch (vCenter Server 7.0 U3c or later) immediately.
- Verify that the Virtual SAN Health Check plug‑in is disabled if not required for operations.
- Run an enterprise‑wide vulnerability scan to confirm no other unpatched instances exist.
- Document the remediation steps in your change‑management system to create audit‑ready evidence.
- Integrate the patch‑status into continuous control‑mapping dashboards for ongoing assurance.
Source: CISA KEV – CVE‑2021‑21985