# CVE-2021-22005: VMware vCenter Server - Arbitrary File Upload

> Live exploitation tracking for CVE-2021-22005 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-22005

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** VMware vCenter Server
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** enterprise_software

## Description

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to execute code on vCenter Server by uploading a specially crafted file.

## CrowdSec analysis

[CVE-2021-22005](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-22005), a vulnerability in VMware vCenter Server and VMware Cloud Foundation allows attackers with network access to port 443 to exploit an arbitrary file upload flaw in the Analytics service. By uploading specially crafted files, malicious actors can achieve remote code execution on the vCenter Server, potentially leading to full system compromise and further attacks within the virtual infrastructure.

CrowdSec has been tracking this vulnerability and its exploits since 12th of June 2025.

CrowdSec network observations suggest that most exploitation of CVE-2021-22005 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2021-22005 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending POST requests to `/analytics/telemetry/ph/api/hyper/send`, allowing them to upload arbitrary files and potentially execute code on vulnerable VMware vCenter Server instances.

## Timeline

- 2021-09-23: CVE Published. CVE-2021-22005 is published to NVD.
- 2021-11-03: CISA KEV. CVE-2021-22005 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2021-11-17: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2025-06-12: Rule Released. CrowdSec releases a rule to detect CVE-2021-22005 exploitation attempts against the CrowdSec Network.
- 2025-06-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-22005 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22005.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-22005) follows observed exploitation activity for CVE-2021-22005. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.