# CVE-2021-22017: VMware vCenter Server, VMware Cloud Foundation - SSRF

> Live exploitation tracking for CVE-2021-22017 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-22017

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** VMware vCenter Server, VMware Cloud Foundation
- **Tags:** enterprise_software, management_panel

## Description

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to bypass proxy leading to internal endpoints being accessed.

## CrowdSec analysis

[CVE-2021-22017](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-22017) is a server-side request forgery (SSRF) vulnerability in VMware vCenter Server and VMware Cloud Foundation, stemming from improper URI normalization in the rhttproxy component. Attackers with network access to port 443 can exploit this flaw to bypass the proxy and access internal endpoints, potentially exposing sensitive internal services to unauthorized access.

CrowdSec has been tracking this vulnerability and its exploits since 18th of February 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2021-22017 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2021-22017 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2021-22017 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers exploit this vulnerability by sending crafted POST requests to endpoints containing `/analytics/ceip/sdk/..;/..;/..;/analytics/ph/api/dataapp/agent`, abusing improper URI normalization to bypass proxy controls and access internal vCenter Server APIs.

## Timeline

- 2021-09-23: CVE Published. CVE-2021-22017 is published to NVD.
- 2022-01-10: CISA KEV. CVE-2021-22017 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-01-24: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-02-18: Rule Released. CrowdSec releases a rule to detect CVE-2021-22017 exploitation attempts against the CrowdSec Network.
- 2026-02-20: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-22017 for the first time.

## References

- https://www.vmware.com/security/advisories/VMSA-2021-0020.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22017
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22017.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-22017) follows observed exploitation activity for CVE-2021-22017. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.