{"vulnerability": "CVE-2021-21986", "sightings": [{"uuid": "7e5cd1cf-c80b-41c5-8ef8-8b9c702b954f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21986", "type": "seen", "source": "https://t.me/true_secator/1751", "content": "VMware \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0430\u043f\u0434\u0435\u0439\u0442, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u043d\u043e\u0432\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-21985, \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d vCenter \u0432\u0435\u0440\u0441\u0438\u0439 6.5, 6.7 \u0438 7.0. \n\n\u041e\u0448\u0438\u0431\u043a\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 (9.8 \u0438\u0437 10 \u043f\u043e CVSS) \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 (RCE) \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0445\u0430\u043a\u0435\u0440\u0443 \u043d\u0443\u0436\u043d\u043e \u043b\u0438\u0448\u044c \u0438\u043c\u0435\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a 443 \u043f\u043e\u0440\u0442\u0443. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 vSAN Health Check, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u0432\u043e \u0432\u0441\u0435\u0445 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044b\u0445 vCenter.\n\nCVE-2021-21985 \u0431\u044b\u043b\u0430 \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 Qihoo 360, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 \u043f\u043e\u0434\u0433\u0430\u0434\u0438\u043b\u0438 VMware, \u0440\u0435\u0437\u043a\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0432 PoC \u0434\u043b\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 CVE-2021-21972 \u0432 \u0442\u043e\u043c \u0436\u0435 \u0441\u0430\u043c\u043e\u043c vCenter.\n\n\u0412 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0434\u044b\u0440\u043a\u0435 \u0441\u0432\u0435\u0436\u0438\u0439 \u043f\u0430\u0442\u0447 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0442\u0430\u043a\u0436\u0435 CVE-2021-21986 \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u044c\u044e 6,5, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u043c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043c\u043e\u0434\u0443\u043b\u044f\u0445 vCenter. \u041d\u043e \u044d\u0442\u043e, \u043d\u0430 \u0441\u0430\u043c\u043e\u043c \u0434\u0435\u043b\u0435, \u043d\u0435 \u0442\u0430\u043a \u0432\u0430\u0436\u043d\u043e. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0437\u0430\u043a\u0440\u044b\u0432 \u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 \u0432\u044b \u0437\u0430\u043a\u0440\u043e\u0435\u0442\u0435 \u0438 \u044d\u0442\u0443.\n\n\u041d\u0443 \u0430 \u043a\u0442\u043e \u043f\u0440\u0438 \u0442\u0430\u043a\u0438\u0445 \u0432\u0432\u043e\u0434\u043d\u044b\u0445 \u043d\u0435 \u0431\u0443\u0434\u0435\u0442 \u0430\u043f\u0434\u0435\u0439\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0438 vCenter - \u0442\u043e\u0442 \u0441\u0430\u043c \u0441\u0435\u0431\u0435 \u0414\u0436\u0435\u043d\u043d\u0438\u0444\u0435\u0440 \u041f\u0441\u0430\u043a\u0438.", "creation_timestamp": "2021-05-26T11:23:27.000000Z"}, {"uuid": "41d50844-edd1-4f72-a35d-52548beaefde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21986", "type": "seen", "source": "https://t.me/S_E_Reborn/249", "content": "CVE-2021-21985/CVE-2021-21986 : VMware vSphere Client (HTML5) contains a remote code execution vulnerability\n\nhttps://attackerkb.com/topics/X85GKjaVER/cve-2021-21985", "creation_timestamp": "2021-06-01T21:11:16.000000Z"}, {"uuid": "0b16b376-8daa-4559-8691-55a7f6b73d25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21986", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3493", "content": "#Threat_Research\n1. The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server (PoC for CVE-2021-21985/CVE-2021-21986)\nhttps://attackerkb.com/topics/X85GKjaVER/cve-2021-21985#rapid7-analysis\n2. Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices\nhttps://www.fireeye.com/blog/threat-research/2021/05/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices.html", "creation_timestamp": "2021-05-30T13:43:01.000000Z"}, {"uuid": "d70064fb-1ac8-48c1-b97b-ac2f47c38baf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21986", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1339", "content": "Thousands of Vulnerable VMWare vCenter Servers Still Publicly Exposed (CVE-2021-21985, CVE-2021-21986) https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/thousands-of-vulnerable-vmware-vcenter-servers-still-publicly-exposed-cve-2021-21985-cve-2021-21986/", "creation_timestamp": "2026-08-03T08:00:03.502755Z"}, {"uuid": "c03af130-8e0a-4fb9-b7a1-131f9c07c88d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21986", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1339", "content": "Thousands of Vulnerable VMWare vCenter Servers Still Publicly Exposed (CVE-2021-21985, CVE-2021-21986) https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/thousands-of-vulnerable-vmware-vcenter-servers-still-publicly-exposed-cve-2021-21985-cve-2021-21986/", "creation_timestamp": "2026-08-04T00:00:45.369464Z"}, {"uuid": "9a2b1845-2896-4f11-894c-96696287f9da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21986", "type": "seen", "source": "https://t.me/reverseame/1339", "content": "Thousands of Vulnerable VMWare vCenter Servers Still Publicly Exposed (CVE-2021-21985, CVE-2021-21986) https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/thousands-of-vulnerable-vmware-vcenter-servers-still-publicly-exposed-cve-2021-21985-cve-2021-21986/", "creation_timestamp": "2026-07-29T12:02:56.799775Z"}, {"uuid": "f420bfdd-86ce-4d9d-b0ff-95e81952808b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21986", "type": "seen", "source": "https://t.me/reverseame/1339", "content": "Thousands of Vulnerable VMWare vCenter Servers Still Publicly Exposed (CVE-2021-21985, CVE-2021-21986) https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/thousands-of-vulnerable-vmware-vcenter-servers-still-publicly-exposed-cve-2021-21985-cve-2021-21986/", "creation_timestamp": "2026-07-30T00:02:46.182184Z"}, {"uuid": "b0e9eb7c-ced3-4297-8d41-dc65e0c5aefc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21986", "type": "seen", "source": "https://t.me/cissp/3350", "content": "Threat Research\nLearning JNDI Injection From\u00a0CVE-2021-21985\nhttps://y4y.space/2021/06/04/learning-jndi-injection-from-cve-2021-21985\n\n Offensive security \n1. Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelg\u00e4nging\nhttps://github.com/hasherezade/transacted_hollowing\n2. I/O Rings - When One I/O Operation is Not Enough...\nhttps://windows-internals.com/i-o-rings-when-one-i-o-operation-is-not-enough\n\nCVE-2021-21985/CVE-2021-21986 : VMware vSphere Client (HTML5) contains a remote code execution vulnerability\nhttps://attackerkb.com/topics/X85GKjaVER/cve-2021-21985#rapid7-analysis", "creation_timestamp": "2026-09-01T17:00:48.817754Z"}, {"uuid": "52dae044-a34a-4926-9d36-691f9866c12a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21986", "type": "seen", "source": "https://t.me/hacking_Attack/10443", "content": "Black Hat Ethical Hacking\nVMware Sounds Ransomware Alarm Over Critical Severity Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg VMware Sounds Ransomware Alarm Over Critical Severity BugPost Views: 20 \nReading Time: 1 Minute\nVMware patched a critical bug impacting its vCenter Server platform with a severity rating of 9.8 out of 10. The company said the flaw could allow a remote attacker to exploit its products and take control of a company\u2019s affected system.\nVMware went a step further on Tuesday, calling on IT security teams \u2013\u00a0already on high alert over an uptick in costly and destructive ransomware attacks\u00a0\u2013\u00a0to patch systems fast.\n\n\u201cIn this era of ransomware it is safest to assume that an attacker is already inside the network somewhere, on a desktop and perhaps even in control of a user account, which is why we strongly recommend declaring an emergency change and patching as soon as possible,\u201d wrote VMware\u2019s Bob Plankers, technical marketing architect in a Tuesday post. Critical Bug Impacts Critical Mass?The vulnerability, tracked as CVE-2021-21985, impacts vCenter Server platforms, which is in widespread use and used to administer VMware\u2019s market leading vSphere and ESXi host products.\n\nClaire Tills, a senior research engineer with Tenable wrote in a post commenting on the bug, \u201cpatching these flaws should be a top priority. Successful exploitation would allow an attacker to execute arbitrary commands on the underlying vCenter host.\u201d\nSee Also: PDF Feature \u2018Certified\u2019 Widely Vulnerable to Attack Tills note exploiting the vulnerability is trivial. All an attacker would need to do is be able to access vCenter Server over port 443, she wrote. \u201cEven if an organization has not exposed vCenter Server externally, attackers can still exploit this flaw once inside a network.\u201d\n\nKenna Security\u2019s director of security research Jerry Gamblin, however noted estimates of how many networks are vulnerable attacks is relatively small.\n\n\u201cSome early research from Rapid 7\u00a0shows that only around 6K\u2019s VCenters are exposed directly to the internet, which makes the \u2018blast radius\u2019 tiny and the initial entry point into a network unlikely with this pair of CVES,\u201d Gamblin wrote in an email commentary to Threatpost.\n\nGamblin is referring to both the critical CVE-2021-21985 bug and a second vulnerability reported by VMware on Tuesday, CVE-2021-21986. This second bug has a medium CVSS severity rating of 6.5 and is tied to an authentication mechanism issue in vCenter Server plugins.\nSee Also: Offensive Security Tool: Snallygaster Breaking Down the Critical BugWorkarounds and updates are available to mitigate both flaws, according to VMware.\n\n\u201cThe vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server,\u201d VMware\u2019s security bulletin states for the critical (CVE-2021-21985) bug. \u201cThe affected Virtual SAN Health Check plug-in is enabled by default in all vCenter Server deployments, whether or not vSAN is being used.\u201d\n\nVMware\u2019s Virtual San (or vSAN) is a software-defined storage solution that typically supports hyper-converged infrastructure. The Health Check plug-in \u201cchecks to monitor the status of cluster components, diagnose issues, and troubleshoot problems,\u201d according to a VMware description of the tool.\n\nVMware credited the researcher identified only as \u201cRicter Z\u201d of 360 Noah Lab for finding the bug. See Also: Hacking Stories: Xbox UndergroundSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:41.061425Z"}, {"uuid": "af32e8f5-1c33-4490-a307-8dd7062ba451", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21986", "type": "seen", "source": "https://t.me/hacking_Attack/11556", "content": "Black Hat Ethical Hacking\nVMware Sounds Ransomware Alarm Over Critical Severity Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg VMware Sounds Ransomware Alarm Over Critical Severity BugPost Views: 402 \nReading Time: 1 Minute\nVMware patched a critical bug impacting its vCenter Server platform with a severity rating of 9.8 out of 10. The company said the flaw could allow a remote attacker to exploit its products and take control of a company\u2019s affected system.\nVMware went a step further on Tuesday, calling on IT security teams \u2013\u00a0already on high alert over an uptick in costly and destructive ransomware attacks\u00a0\u2013\u00a0to patch systems fast.\n\n\u201cIn this era of ransomware it is safest to assume that an attacker is already inside the network somewhere, on a desktop and perhaps even in control of a user account, which is why we strongly recommend declaring an emergency change and patching as soon as possible,\u201d wrote VMware\u2019s Bob Plankers, technical marketing architect in a Tuesday post. Critical Bug Impacts Critical Mass?The vulnerability, tracked as CVE-2021-21985, impacts vCenter Server platforms, which is in widespread use and used to administer VMware\u2019s market leading vSphere and ESXi host products.\n\nClaire Tills, a senior research engineer with Tenable wrote in a post commenting on the bug, \u201cpatching these flaws should be a top priority. Successful exploitation would allow an attacker to execute arbitrary commands on the underlying vCenter host.\u201d\nSee Also: PDF Feature \u2018Certified\u2019 Widely Vulnerable to Attack Tills note exploiting the vulnerability is trivial. All an attacker would need to do is be able to access vCenter Server over port 443, she wrote. \u201cEven if an organization has not exposed vCenter Server externally, attackers can still exploit this flaw once inside a network.\u201d\n\nKenna Security\u2019s director of security research Jerry Gamblin, however noted estimates of how many networks are vulnerable attacks is relatively small.\n\n\u201cSome early research from Rapid 7\u00a0shows that only around 6K\u2019s VCenters are exposed directly to the internet, which makes the \u2018blast radius\u2019 tiny and the initial entry point into a network unlikely with this pair of CVES,\u201d Gamblin wrote in an email commentary to Threatpost.\n\nGamblin is referring to both the critical CVE-2021-21985 bug and a second vulnerability reported by VMware on Tuesday, CVE-2021-21986. This second bug has a medium CVSS severity rating of 6.5 and is tied to an authentication mechanism issue in vCenter Server plugins.\nSee Also: Offensive Security Tool: Snallygaster Breaking Down the Critical BugWorkarounds and updates are available to mitigate both flaws, according to VMware.\n\n\u201cThe vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server,\u201d VMware\u2019s security bulletin states for the critical (CVE-2021-21985) bug. \u201cThe affected Virtual SAN Health Check plug-in is enabled by default in all vCenter Server deployments, whether or not vSAN is being used.\u201d\n\nVMware\u2019s Virtual San (or vSAN) is a software-defined storage solution that typically supports hyper-converged infrastructure. The Health Check plug-in \u201cchecks to monitor the status of cluster components, diagnose issues, and troubleshoot problems,\u201d according to a VMware description of the tool.\n\nVMware credited the researcher identified only as \u201cRicter Z\u201d of 360 Noah Lab for finding the bug. See Also: Hacking Stories: Xbox UndergroundSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitle[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:38.554719Z"}, {"uuid": "7e4315d4-a94a-4f3e-a163-ea2f857f3d46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21986", "type": "seen", "source": "https://t.me/hacking_Attack/11556", "content": "Black Hat Ethical Hacking\nVMware Sounds Ransomware Alarm Over Critical Severity Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg VMware Sounds Ransomware Alarm Over Critical Severity BugPost Views: 402 \nReading Time: 1 Minute\nVMware patched a critical bug impacting its vCenter Server platform with a severity rating of 9.8 out of 10. The company said the flaw could allow a remote attacker to exploit its products and take control of a company\u2019s affected system.\nVMware went a step further on Tuesday, calling on IT security teams \u2013\u00a0already on high alert over an uptick in costly and destructive ransomware attacks\u00a0\u2013\u00a0to patch systems fast.\n\n\u201cIn this era of ransomware it is safest to assume that an attacker is already inside the network somewhere, on a desktop and perhaps even in control of a user account, which is why we strongly recommend declaring an emergency change and patching as soon as possible,\u201d wrote VMware\u2019s Bob Plankers, technical marketing architect in a Tuesday post. Critical Bug Impacts Critical Mass?The vulnerability, tracked as CVE-2021-21985, impacts vCenter Server platforms, which is in widespread use and used to administer VMware\u2019s market leading vSphere and ESXi host products.\n\nClaire Tills, a senior research engineer with Tenable wrote in a post commenting on the bug, \u201cpatching these flaws should be a top priority. Successful exploitation would allow an attacker to execute arbitrary commands on the underlying vCenter host.\u201d\nSee Also: PDF Feature \u2018Certified\u2019 Widely Vulnerable to Attack Tills note exploiting the vulnerability is trivial. All an attacker would need to do is be able to access vCenter Server over port 443, she wrote. \u201cEven if an organization has not exposed vCenter Server externally, attackers can still exploit this flaw once inside a network.\u201d\n\nKenna Security\u2019s director of security research Jerry Gamblin, however noted estimates of how many networks are vulnerable attacks is relatively small.\n\n\u201cSome early research from Rapid 7\u00a0shows that only around 6K\u2019s VCenters are exposed directly to the internet, which makes the \u2018blast radius\u2019 tiny and the initial entry point into a network unlikely with this pair of CVES,\u201d Gamblin wrote in an email commentary to Threatpost.\n\nGamblin is referring to both the critical CVE-2021-21985 bug and a second vulnerability reported by VMware on Tuesday, CVE-2021-21986. This second bug has a medium CVSS severity rating of 6.5 and is tied to an authentication mechanism issue in vCenter Server plugins.\nSee Also: Offensive Security Tool: Snallygaster Breaking Down the Critical BugWorkarounds and updates are available to mitigate both flaws, according to VMware.\n\n\u201cThe vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server,\u201d VMware\u2019s security bulletin states for the critical (CVE-2021-21985) bug. \u201cThe affected Virtual SAN Health Check plug-in is enabled by default in all vCenter Server deployments, whether or not vSAN is being used.\u201d\n\nVMware\u2019s Virtual San (or vSAN) is a software-defined storage solution that typically supports hyper-converged infrastructure. The Health Check plug-in \u201cchecks to monitor the status of cluster components, diagnose issues, and troubleshoot problems,\u201d according to a VMware description of the tool.\n\nVMware credited the researcher identified only as \u201cRicter Z\u201d of 360 Noah Lab for finding the bug. See Also: Hacking Stories: Xbox UndergroundSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitle[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:14.245573Z"}, {"uuid": "91b2a280-ddf6-4a50-9ecc-f431e6617c89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21986", "type": "seen", "source": "https://t.me/hacking_Attack/10443", "content": "Black Hat Ethical Hacking\nVMware Sounds Ransomware Alarm Over Critical Severity Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg VMware Sounds Ransomware Alarm Over Critical Severity BugPost Views: 20 \nReading Time: 1 Minute\nVMware patched a critical bug impacting its vCenter Server platform with a severity rating of 9.8 out of 10. The company said the flaw could allow a remote attacker to exploit its products and take control of a company\u2019s affected system.\nVMware went a step further on Tuesday, calling on IT security teams \u2013\u00a0already on high alert over an uptick in costly and destructive ransomware attacks\u00a0\u2013\u00a0to patch systems fast.\n\n\u201cIn this era of ransomware it is safest to assume that an attacker is already inside the network somewhere, on a desktop and perhaps even in control of a user account, which is why we strongly recommend declaring an emergency change and patching as soon as possible,\u201d wrote VMware\u2019s Bob Plankers, technical marketing architect in a Tuesday post. Critical Bug Impacts Critical Mass?The vulnerability, tracked as CVE-2021-21985, impacts vCenter Server platforms, which is in widespread use and used to administer VMware\u2019s market leading vSphere and ESXi host products.\n\nClaire Tills, a senior research engineer with Tenable wrote in a post commenting on the bug, \u201cpatching these flaws should be a top priority. Successful exploitation would allow an attacker to execute arbitrary commands on the underlying vCenter host.\u201d\nSee Also: PDF Feature \u2018Certified\u2019 Widely Vulnerable to Attack Tills note exploiting the vulnerability is trivial. All an attacker would need to do is be able to access vCenter Server over port 443, she wrote. \u201cEven if an organization has not exposed vCenter Server externally, attackers can still exploit this flaw once inside a network.\u201d\n\nKenna Security\u2019s director of security research Jerry Gamblin, however noted estimates of how many networks are vulnerable attacks is relatively small.\n\n\u201cSome early research from Rapid 7\u00a0shows that only around 6K\u2019s VCenters are exposed directly to the internet, which makes the \u2018blast radius\u2019 tiny and the initial entry point into a network unlikely with this pair of CVES,\u201d Gamblin wrote in an email commentary to Threatpost.\n\nGamblin is referring to both the critical CVE-2021-21985 bug and a second vulnerability reported by VMware on Tuesday, CVE-2021-21986. This second bug has a medium CVSS severity rating of 6.5 and is tied to an authentication mechanism issue in vCenter Server plugins.\nSee Also: Offensive Security Tool: Snallygaster Breaking Down the Critical BugWorkarounds and updates are available to mitigate both flaws, according to VMware.\n\n\u201cThe vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server,\u201d VMware\u2019s security bulletin states for the critical (CVE-2021-21985) bug. \u201cThe affected Virtual SAN Health Check plug-in is enabled by default in all vCenter Server deployments, whether or not vSAN is being used.\u201d\n\nVMware\u2019s Virtual San (or vSAN) is a software-defined storage solution that typically supports hyper-converged infrastructure. The Health Check plug-in \u201cchecks to monitor the status of cluster components, diagnose issues, and troubleshoot problems,\u201d according to a VMware description of the tool.\n\nVMware credited the researcher identified only as \u201cRicter Z\u201d of 360 Noah Lab for finding the bug. See Also: Hacking Stories: Xbox UndergroundSource: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/Untitled[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:17.590184Z"}, {"uuid": "4eb788a5-5d1f-4850-a22e-ccc0d1f99a49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21986", "type": "seen", "source": "https://t.me/cissp/3350", "content": "Threat Research\nLearning JNDI Injection From\u00a0CVE-2021-21985\nhttps://y4y.space/2021/06/04/learning-jndi-injection-from-cve-2021-21985\n\n Offensive security \n1. Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelg\u00e4nging\nhttps://github.com/hasherezade/transacted_hollowing\n2. I/O Rings - When One I/O Operation is Not Enough...\nhttps://windows-internals.com/i-o-rings-when-one-i-o-operation-is-not-enough\n\nCVE-2021-21985/CVE-2021-21986 : VMware vSphere Client (HTML5) contains a remote code execution vulnerability\nhttps://attackerkb.com/topics/X85GKjaVER/cve-2021-21985#rapid7-analysis", "creation_timestamp": "2026-09-02T01:04:36.214232Z"}]}