How to Fix CVE-2021-22005: Arbitrary File Upload in VMware vCenter Server

⚠️ CISA KEV listing: active exploitation. Added to the Known Exploited Vulnerabilities catalog on 2021-11-03; remediation due date for federal civilian agencies: 2021-11-17. Known ransomware use.

What is CVE-2021-22005?

CVE-2021-22005 is an arbitrary file upload vulnerability in the Analytics service (part of the Customer Experience Improvement Program, CEIP) that ships with VMware vCenter Server. An attacker with network access to TCP port 443 can send a crafted request to the Analytics endpoint that writes an attacker-controlled file to a location of their choosing on the appliance. Because the upload is not properly constrained to a safe directory (the root cause is CWE-22, improper limitation of a pathname to a restricted directory, or path traversal), the attacker can drop a payload such as a JSP webshell into a web-served path and then execute it.

That chain turns a file-write primitive into unauthenticated remote code execution as root on the vCenter appliance. There is no login step and no user interaction: anyone who can reach 443 can run code. That combination is exactly why the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). vCenter is the management brain of an entire vSphere estate, so code execution there is typically equivalent to control of every ESXi host and guest VM behind it.

The vulnerability is present in the default configuration. It does not depend on whether you actively use CEIP, because the Analytics service is reachable regardless. CISA confirmed in-the-wild exploitation and added it to the Known Exploited Vulnerabilities catalog within weeks of disclosure. Treat any unpatched, network-reachable vCenter as a live emergency.

Identify whether you are affected

You are affected if you run any of the following below the patched build:

• vCenter Server 7.x earlier than 7.0 U2c
• vCenter Server 6.7 earlier than 6.7 U3o
• VMware Cloud Foundation 4.x earlier than 4.3 (which bundles vCenter)
• VMware Cloud Foundation 3.x earlier than 3.10.2.2

Note that vCenter Server 6.5 was end of general support before this advisory and did not receive a fixed build through the normal channel. If you are still on 6.5, upgrade to a supported line first.

Find your exact build number from the vSphere Client (Help → About), from the Appliance Management Interface at https://<vcenter>:5480 under Summary, or over SSH on the vCenter Server Appliance (VCSA):

# On the VCSA shell (enable SSH from VAMI if needed)
vpxd -v

# Or read the build directly
cat /etc/vmware/.buildInfo 2>/dev/null
grep -i build /storage/log/vmware/vpxd/vpxd.log | head -1

Cross-reference the build number against the “Fixed Version” column in VMSA-2021-0020. The patched 7.0 U2c build is 18356314 and the 6.7 U3o build is 18485166; if your build is lower than the one for your line, this CVE applies and you should patch on an emergency timeline.

How to fix CVE-2021-22005

There is no apt, dnf, yum or Windows Update path for this. vCenter Server is a sealed virtual appliance (VCSA), so you patch it through VMware's own update mechanism. The supported fix is to update vCenter to one of these builds:

• vCenter Server 7.0 Update 2c (build 18356314) for the 7.x line
• vCenter Server 6.7 Update 3o (build 18485166) for the 6.7 line
• VMware Cloud Foundation 4.3 (or apply the async patch) for the 4.x line
• VMware Cloud Foundation 3.10.2.2 for the 3.x line

Do not let the embedded ESXi version distract you. This is a vCenter fix, applied to the vCenter appliance, not to the ESXi hosts.

Patch the VCSA through the Appliance Management Interface (VAMI)

1. Snapshot first. Take a cold snapshot of the vCenter VM (and a file-based backup from VAMI → Backup) so you can roll back if the update fails mid-flight. vCenter updates change the embedded vPostgres schema, so a backup is not optional.
2. Open VAMI at https://<vcenter-fqdn>:5480 and sign in as root.
3. Go to Update. Click Check Updates → Check Repository (online) or stage the patch ISO and choose Check CD ROM if your VCSA has no internet egress.
4. Select the 7.0 U2c / 6.7 U3o (or VCF) build, click Stage and Install, accept the EULA, and let it run. The appliance services restart automatically and the UI is unavailable for several minutes.

Or patch from the appliance shell

# SSH to the VCSA as root, then enter the appliance shell
software-packages stage --url            # online repo
# or, for an attached ISO:
software-packages stage --iso

# Review what will be installed, then apply
software-packages list --staged
software-packages install --staged

# vCenter services restart as part of install; do not interrupt it

If you run VMware Cloud Foundation, drive the update through SDDC Manager rather than touching the embedded vCenter directly, so the bundle inventory stays consistent. Apply the VCF 4.3 / 3.10.2.2 bundle (or the named async vCenter patch) per the VMSA.

Verify the fix landed

# 1. Confirm the build now matches the fixed build for your line
vpxd -v                  # expect 7.0 U2c (18356314) or 6.7 U3o (18485166)

# 2. Confirm core services came back up healthy
service-control --status --all
vmon-cli -l

# 3. Re-scan with Nessus / Qualys / Tenable; CVE-2021-22005 must clear

VMware also published a manual-fix shell script (in KB 85717) for sites that could not take downtime immediately. If you applied that workaround earlier, you still need to install the patched build. The script was a stopgap, not the fix, and it had to be reapplied after some operations.

If you can't patch immediately

VMware published a temporary workaround in KB 85717: a shell script that edits the endpoint configuration so the vulnerable Analytics path returns a 404, then restarts the affected services. It buys time but is explicitly a stopgap: the patched build remains the only supported fix, and the script must be reapplied if you make certain configuration changes. While you plan the upgrade window:

• Apply the KB 85717 workaround if you genuinely cannot patch today, then schedule the U2c / U3o upgrade immediately after.
• Restrict network reach. vCenter management interfaces, especially port 443, should never be exposed to the internet. Put vCenter behind a management VLAN, a jump host, or a firewall rule that limits port 443 to the admin source IPs that legitimately need it. This shrinks the attack surface without changing the application.
• Increase logging and alerting on the Analytics endpoint. Watch /storage/log/vmware/analytics/ and the rhttpproxy logs for unexpected POSTs to the CEIP upload path, and alert on any new JSP files appearing under the vCenter web roots.

Given that this CVE is in CISA KEV, the time-to-patch window for federal civilian agencies has been set, and most enterprises track those due dates as the practical floor, not a federal-only target.

Resolve

1. Confirm the build with vpxd -v matches or exceeds 7.0 U2c (18356314) or 6.7 U3o (18485166) for your line. VMSA-2021-0020 lists the fixed builds for every product line explicitly.

1. Check that all vCenter services restarted clean with service-control --status --all and vmon-cli -l. A vCenter upgrade that half-fails and leaves vpxd or the Analytics service down is a common operational outcome; do not consider the change complete until every service is running.

1. Hunt for pre-patch compromise. Because this CVE was exploited in the wild before many sites patched, treat an internet-reachable vCenter as potentially already breached. Look for unexpected JSP files under the vCenter web roots, suspicious POSTs to the Analytics/CEIP path in the rhttpproxy and analytics logs, new SSO or local accounts, and unexplained outbound connections from the appliance.

1. Re-run a vulnerability scanner (Nessus, Qualys, Tenable, OpenVAS) against the vCenter host after patching. It should no longer flag CVE-2021-22005. If it still does, confirm you updated vCenter itself and not just the surrounding ESXi hosts.

1. Document the patch evidence for KEV reporting. Vulnerabilities in CISA KEV are tracked by FCEB agencies under BOD 22-01. Even outside the federal sector, the same evidence (build number, patch date, scanner clean report) is what auditors typically ask for.

Frequently asked questions

Which vCenter Server versions fix CVE-2021-22005?

vCenter Server 7.0 Update 2c (build 18356314) fixes the 7.x line and 6.7 Update 3o (build 18485166) fixes the 6.7 line. VMware Cloud Foundation is fixed in 4.3 and 3.10.2.2. There is no patched build for the end-of-life 6.5 line, so move to a supported line first.

Does CVE-2021-22005 require authentication to exploit?

No. It is an unauthenticated arbitrary file upload in the vCenter Analytics (CEIP) service. Anyone who can reach TCP port 443 can upload a crafted file and chain it into remote code execution as root, with no login and no user interaction. That is why the CVSS base score is 9.8.

Is there a workaround if I cannot patch vCenter immediately?

VMware published a temporary workaround in KB 85717: a shell script that makes the vulnerable Analytics endpoint return 404 and restarts the affected services. It is a stopgap only. You must still install vCenter 7.0 U2c or 6.7 U3o, and the script may need to be reapplied after some configuration changes.

Is CVE-2021-22005 being exploited in the wild?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03 and it has been used in ransomware campaigns against internet-reachable vCenter servers. Treat any unpatched, network-reachable vCenter as already at risk.

References

• Official vendor advisory: https://www.vmware.com/security/advisories/VMSA-2021-0020.html
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-22005
• CISA KEV catalog entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

This guide was assembled from the official vendor advisory, the NVD record, and the CISA KEV listing on 2026-05-25. Always confirm against the vendor's advisory before applying changes in production. Byline: Sai Kiran Pandrala.

Related fixes

Related weaknesses in the same component worth addressing at the same time:

• How to Fix CVE-2021-21985: Remote Code Execution in VMware vCenter Server and VMware Cloud Foundation
• How to Fix CVE-2021-21973: Server-Side Request Forgery in VMware Cloud Foundation
• How to Fix CVE-2021-21975: Server-Side Request Forgery in VMware vRealize Operations
• How to Fix CVE-2021-22017: Security Vulnerability in VMware vCenter Server
• How to Fix CVE-2021-21972: Remote Code Execution in VMware Cloud Foundation