CVE-2021-21975

Act now ● On CISA KEV — actively exploited used in ransomware

Actively exploited — on the CISA KEV list.

CVSS base

7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS — probability of exploitation (30 days)

78.3%

99.6th percentile

CISA KEV

Listed

Added 2022-01-18 · patch by 2022-02-01

Weakness / dates

CWE-918

Published 2021-03-31 · modified 2026-08-12

CVSS breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector	N	Network
Attack Complexity	L	Low
Privileges Required	N	None
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	H	High
Integrity	N	None
Availability	N	None

Timeline

2021-03-31 — Published (NVD)
2022-01-18 — Added to CISA KEV (actively exploited)
2022-02-01 — CISA patch-by deadline
2026-08-12 — Last modified (NVD)

Description

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.

Affected

vmware

References

Official: NVD · CVE.org