Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network acces…

published 2021-03-31 5y ago modified 2026-10-02 last mo. also EUVD-2021-9146

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2022-01-18, used in ransomware
epss: 78.0%; EPSS 78.0% chance of exploitation in 30 days, percentile 99.5%
public exploits: 1; Metasploit, plus a Nuclei check

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.

Patch / fix

cisa required action Apply updates per vendor instructions.

Is CVE-2021-21975 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

2021-03-30 First public exploit (Metasploit exploit/linux/http/vmware_vrops_mgr_ssrf_rce)
2021-03-31 Published
2022-01-18 Added to CISA KEV
2022-02-01 CISA patch deadline
2026-08-12 CISA SSVC: exploitation active

Known exploited

Added: 4y ago (2022-01-18)
Patch by: 2022-02-01 (4y ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply updates per vendor instructions.
Vendor, product: VMware, vRealize Operations Manager API
CISA name: VMware Server Side Request Forgery in vRealize Operations Manager API

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

T1190 Exploit Public-Facing Application exploitation

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 2mo ago (2026-08-12)

Exploit prediction

78.00% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/linux/http/vmware_vrops_mgr_ssrf_rce VMware vRealize Operations (vROps) Manager SSRF RCE metasploit exploit, excellent rank, 2021-03-30
Nuclei template vRealize Operations Manager API - Server-Side Request Forgery nuclei detection template
packetstormsecurity.com http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

n/a VMware vRealize Operations

Classification

Weakness

CWE-918 Server-Side Request Forgery

Technology feeds

VMware rss critical rss

References

packetstormsecurity.com /files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html
exploit, third-party-advisory, vdb-entry
vmware.com /security/advisories/VMSA-2021-0004.html
vendor-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21975
government-resource, us-government-resource

Sources

CVE List CVE-2021-21975
NVD CVE-2021-21975

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.