CVE-2021-22005: VMware vCenter Server File‑Upload Vulnerability Enables Remote Code Execution
What It Is – VMware vCenter Server’s Analytics service contains an insecure file‑upload endpoint. An unauthenticated user who can reach TCP 443 can upload a crafted file that triggers arbitrary code execution on the vCenter host.
Exploitability – Public exploits have been observed; the vulnerability carries a CVSS 3.1 base score of 9.8 (Critical) and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
Affected Products – VMware vCenter Server (all supported versions prior to the security patch released in May 2022).
Why It Matters for Trust & Control Assurance
- Continuous vulnerability monitoring is required to prove that critical assets are patched in a timely manner.
- Evidence of patch deployment feeds directly into audit‑ready documentation for multiple frameworks.
- A single unpatched vCenter instance can compromise an entire virtual infrastructure, making the control of “vulnerability management” a high‑visibility trust signal for enterprise buyers.
Recommended Actions
- Deploy VMware’s security patch for the affected vCenter versions immediately.
- Verify patch levels across every vCenter instance via automated inventory tools.
- Integrate CVE‑2021‑22005 into your vulnerability‑management feed and set a high‑severity alert.
- Enable detailed logging of file‑upload activity on the Analytics service and monitor for anomalous requests.
Source: CISA KEV – CVE‑2021‑22005