The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 3 Nov 2021.
Severity
Critical 9.8
Published
26 May 2021
Last changed
12 Aug 2026
Added to UpHeron
1 Nov 2026
Sources
NVD
Affected software
Software
Affected versions
VMware vCenter ServerServers and applications · cpe:a:vmware:vcenter_server
Version 7.0-update2
Version 7.0-update1d
Version 7.0-update1
Version 7.0-d
All 51 release lines
Version 6.5-a
Version 6.5-b
Version 6.5-c
Version 6.5-update1b
Version 6.5-update1c
Version 6.5-update2b
Version 6.5-update2c
Version 6.5
Version 6.5-d
Version 6.5-e
Version 6.5-f
Version 6.5-update1
Version 6.5-update1d
Version 6.5-update1e
Version 6.5-update1g
Version 6.5-update2
Version 6.5-update2d
Version 6.5-update2g
Version 6.5-update3
Version 6.5-update3d
Version 6.5-update3f
Version 6.5-update3k
Version 6.5-update3n
Version 6.7-a
Version 6.7-b
Version 6.7-update1b
Version 6.7-update2a
Version 6.7-update2c
Version 6.7-update3a
Version 6.7-update3b
Version 6.7
Version 6.7-d
Version 6.7-update1
Version 6.7-update2
Version 6.7-update3
Version 6.7-update3f
Version 6.7-update3g
Version 6.7-update3j
Version 6.7-update3l
Version 6.7-update3m
Version 7.0-a
Version 7.0-b
Version 7.0-c
Version 7.0-update1a
Version 7.0-update1c
Version 7.0-update2a
Version 7.0
Version 7.0-d
Version 7.0-update1
Version 7.0-update1d
Version 7.0-update2
Known exploited
CISA name
VMware vCenter Server Improper Input Validation Vulnerability