Critical Improper Access Control in VMware vCenter Server (CVE‑2021‑22017) Threatens Enterprise Management

Critical Improper Access Control in VMware vCenter Server (CVE‑2021‑22017) Threatens Enterprise Management

What It Is

CVE‑2021‑22017 is a critical‑severity flaw in the rhttproxy component of VMware vCenter Server. The vulnerability stems from improper URI‑normalization, allowing an unauthenticated attacker to bypass access controls and execute arbitrary code on the vCenter host.

Exploitability

Public proof‑of‑concept code was released shortly after the advisory, and multiple threat‑intel feeds reported active exploitation in the wild. The CVSS v3.1 base score is 9.8 (Critical).

Affected Products

• VMware vCenter Server 6.5, 6.7, and 7.0 (all supported patch levels prior to the December 2021 security update).

Why It Matters for Compliance & Audit Readiness

The flaw directly undermines Access Control (NIST AC‑1, AC‑2) and Vendor Management controls that require organizations to maintain a defensible patch‑management process. Demonstrating timely remediation provides concrete evidence of due‑diligence for auditors and supports continuous control monitoring programs.

Recommended Actions

• Inventory: Identify every vCenter instance in scope and record its current patch level.
• Patch: Apply VMware Security Advisory VMSA‑2021‑0010 (or later) to remediate the issue.
• Segmentation: Restrict network access to vCenter management interfaces to trusted subnets only.
• Monitor: Enable logging for rhttproxy requests and set up alerts for anomalous URI patterns.
• Evidence: Capture patch‑installation logs and network‑segmentation rules as part of your audit trail.

Source: https://nvd.nist.gov/vuln/detail/CVE-2021-22017