VMware vCenter Server, VMware Cloud Foundation - SSRF (CVE-2021-22017)

CVE-2021-22017 is a server-side request forgery (SSRF) vulnerability in VMware vCenter Server and VMware Cloud Foundation, stemming from improper URI normalization in the rhttproxy component. Attackers with network access to port 443 can exploit this flaw to bypass the proxy and access internal endpoints, potentially exposing sensitive internal services to unauthorized access.

CrowdSec has been tracking this vulnerability and its exploits since 18th of February 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2021-22017 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2021-22017 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2021-22017 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers exploit this vulnerability by sending crafted POST requests to endpoints containing /analytics/ceip/sdk/..;/..;/..;/analytics/ph/api/dataapp/agent, abusing improper URI normalization to bypass proxy controls and access internal vCenter Server APIs.