CVE-2021-21975
CISA KEV RANSOMWARE
ACT NOW
Priority: 0.00
BB Relevance:
0/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Server Side Request Forgery (SSRF) in vRealize Operations Manager API prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API to perform a SSRF attack to steal administrative credentials.
CISA Known Exploited Vulnerability
Vendor / Product
VMware — vRealize Operations Manager API
Date Added
2022-01-18
Remediation Due
2022-02-01
Ransomware Use
CONFIRMED
https://nvd.nist.gov/vuln/detail/CVE-2021-21975
Weakness Classification (1)
Affected Software (27)
| Vendor | Product | Version |
|---|---|---|
| vmware | cloud_foundation | 3.0 |
| vmware | cloud_foundation | 3.0.1 |
| vmware | cloud_foundation | 3.0.1.1 |
| vmware | cloud_foundation | 3.5 |
| vmware | cloud_foundation | 3.5.1 |
| vmware | cloud_foundation | 3.7 |
| vmware | cloud_foundation | 3.7.1 |
| vmware | cloud_foundation | 3.7.2 |
| vmware | cloud_foundation | 3.8 |
| vmware | cloud_foundation | 3.8.1 |
| vmware | cloud_foundation | 3.9 |
| vmware | cloud_foundation | 3.9.1 |
| vmware | cloud_foundation | 3.10 |
| vmware | cloud_foundation | 4.0 |
| vmware | cloud_foundation | 4.0.1 |
| vmware | vrealize_operations_manager | 7.0.0 |
| vmware | vrealize_operations_manager | 7.5.0 |
| vmware | vrealize_operations_manager | 8.0.0 |
| vmware | vrealize_operations_manager | 8.0.1 |
| vmware | vrealize_operations_manager | 8.1.0 |
| vmware | vrealize_operations_manager | 8.1.1 |
| vmware | vrealize_operations_manager | 8.2.0 |
| vmware | vrealize_operations_manager | 8.3.0 |
| vmware | vrealize_suite_lifecycle_manager | 8.0 |
| vmware | vrealize_suite_lifecycle_manager | 8.0.1 |
| vmware | vrealize_suite_lifecycle_manager | 8.1 |
| vmware | vrealize_suite_lifecycle_manager | 8.2 |
References & Advisories (3)
Vendor Advisory
US Government Resource
Exploit
Third Party Advisory
VDB Entry