Vulnerability threat dossier
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server.
VTP analyst assessment
VMware vCenter Server has a remote code execution flaw in the default-enabled Virtual SAN Health Check plug-in. CISA KEV lists this CVE as exploited globally and notes known ransomware use.
0 record references and 2 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.
CISA KEV does not show exploitation in your environment.
No first-party sensor telemetry is supplied.
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
Review in your environment: if you use affected VMware vCenter Server, check port 443 exposure and remediation status.
First-party deterministic correlation
The request shares exploitation-associated characteristics with CVE-2021-21985, but the evidence does not identify one CVE with sufficient confidence.
Basis: deterministic technical candidate
VTP deterministic assessment
CISA KEV lists this vulnerability as known to be exploited globally.
EPSS is 1.00; this is predictive context, not exploitation evidence.
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.
Material change ledger
Claim provenance
0 primary sources · 0 dependent secondary reports · 0 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
CISA lists global known exploitation. This is not a VTP sensor observation.
Original publications
Technical vulnerability data
Raw observations
First-party honeypot request semantics are potentially consistent with this CVE. This is an unconfirmed candidate match, not proof of exploitation or successful execution.