VMware vCenter Server CVE-2021-22005 (arbitrary file upload in the Analytics/CEIP service on port 443 leading to code execution, used by ransomware, CISA KEV, VMSA-2021-0020): which builds fix it?

What it is: CVE-2021-22005, published in VMware advisory VMSA-2021-0020 in September 2021 (CVSS 9.8), is an arbitrary file upload flaw in vCenter Server's Analytics service. Anyone with network access to vCenter on port 443 could upload a crafted file and run code on vCenter, regardless of how the Customer Experience Improvement Program setting was configured. Exploitation started within days of disclosure; CISA lists it in KEV with known ransomware use. Owning vCenter means owning every ESXi host and VM it manages. Am I affected: - vCenter Server 7.0 and 6.7 (Appliance) before the fixed updates, and VMware Cloud Foundation releases that bundle them. Check the version and build in the vSphere Client (Help > About) or the appliance management interface (port 5480). - Highest risk if vCenter is reachable from user networks or the internet. Fix: 1. Apply the fixed updates from VMSA-2021-0020 (vCenter 7.0 U2c and 6.7 U3o were the fixes for this CVE) or, better, move to a currently supported vCenter release with current patches, which also covers later critical vCenter bugs. 2. If you couldn't patch immediately, VMware published a temporary workaround (KB85717); it's a stopgap only. 3. Restrict vCenter's management interfaces to a dedicated management network; never expose port 443 of vCenter to the internet. 4. If an unpatched vCenter was reachable, hunt for compromise: unexpected files in the analytics service directories, new local accounts, unexpected scheduled tasks and outbound connections; rebuild from a clean appliance if found, and rotate vCenter SSO, administrator and service-account credentials, plus ESXi root passwords. Verify: Help > About shows a fixed or current build, and vCenter is reachable only from the management network. Sources: https://www.vmware.com/security/advisories/VMSA-2021-0020.html https://nvd.nist.gov/vuln/detail/CVE-2021-22005 https://www.cisa.gov/known-exploited-vulnerabilities-catalog