CVE-2021-21975 — VMware Server Side Request Forgery in vRealize Operations Manager API

CVE-2021-21975

HIGH · CVSS 7.5 ⚠ KEV — EXPLOITED

EPSS exploitation probability: 100%

⚠ Listed in the CISA Known Exploited Vulnerabilities catalog — actively exploited.

Published 2022-01-18 · Last modified 2026-08-12T05:17:35.830

Summary

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.

Affected products

VMware — vRealize Operations Manager API

Does this affect you?

Add your gear to cvedb and we'll alert you only when VMware ships something exploited.

Check my exposure →

References

NVD entry
CVE.org record

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.