CVEs / CVE-2021-21975

CVE-2021-21975: VMware Server Side Request Forgery in vRealize Operations Manager API

Known exploited in the CISA KEV catalog since 18 Jan 2022
high 7.5 CVSS 3.1 (NVD)
EPSS 78% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
Last changed at its sources 2 Oct 2026

Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.

Check your servers with Stackurity Already using Stackurity? Search for CVE-2021-21975

Summary

Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
CISA, Known Exploited Vulnerabilities catalog

Description

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.
The CVE record, via NVD · published 31 Mar 2021 · NVD status: Analyzed

Affected and fixed versions

As stated by the CVE record (from the CNA)
Product	Affected	Fixed in
n/a VMware vRealize Operations	VMware vRealize Operations prior to 8.4	—

Exploitation

In CISA KEV since	18 Jan 2022
Due date for US federal agencies	1 Feb 2022
Used in ransomware campaigns	Known
Required action	Apply updates per vendor instructions.

Severity

CVSS 3.1	7.5 high `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` Scored by NVD
Weakness	CWE-918

References

CVE-2021-21975 on NVD
CVE-2021-21975 in the CISA KEV catalog
http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
https://www.vmware.com/security/advisories/VMSA-2021-0004.html Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21975 US Government Resource

Sources

Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.

This product uses data from the NVD API but is not endorsed or certified by the NVD.