CVE-2021-22015

The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. An authenticated local user with non-administrative privilege may exploit these issues to elevate their privileges to root on vCenter Server Appliance.

• CWE-552

• http://packetstormsecurity.com/files/170116/VMware-vCenter-vScalation-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
• https://www.vmware.com/security/advisories/VMSA-2021-0020.htmlPatch, Vendor Advisory
• http://packetstormsecurity.com/files/170116/VMware-vCenter-vScalation-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
• https://www.vmware.com/security/advisories/VMSA-2021-0020.htmlPatch, Vendor Advisory

Published

Sep 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-2201Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-22010The vCenter Server contains a denial-of-service vulnerabilit…7.5
• CVE-2021-22011vCenter Server contains an unauthenticated API endpoint vuln…5.3
• CVE-2021-22012The vCenter Server contains an information disclosure vulner…7.5
• CVE-2021-22013The vCenter Server contains a file path traversal vulnerabil…7.5
• CVE-2021-22014The vCenter Server contains an authenticated code execution …7.2
• CVE-2021-22016The vCenter Server contains a reflected cross-site scripting…6.1
• CVE-2021-22017Rhttproxy as used in vCenter Server contains a vulnerability…5.3
• CVE-2021-22018The vCenter Server contains an arbitrary file deletion vulne…6.5
• CVE-2021-22019The vCenter Server contains a denial-of-service vulnerabilit…7.5
• CVE-2021-2202Vulnerability in the MySQL Server product of Oracle MySQL (c…6.5
• CVE-2021-22020The vCenter Server contains a denial-of-service vulnerabilit…5.5