Security Advisory VMSA-2021-0014 (CVE-2021-21994, CVE-2021-21995)

IMPORTANT Security Advisory that was released earlier yesterday (13-07-2021)

Security Advisory


VMware ESXi updates address authentication and denial of service vulnerabilities (CVE-2021-21994CVE-2021-21995) with a maximum CVSSv3 base score of 7.0.

Known Attack Vectors

A malicious actor with network access to port 5989 on ESXi may exploit this issue to bypass SFCB authentication by sending a specially crafted request.

NOTE: SFCB is disabled by default. The service starts when you install a third-party CIM VIB, for example, when you run the esxcli software vib install -n VIBname command. For successful exploitation, SFCB service should be running. The status of the service can be checked by following the steps mentioned in KB1025757.

Workaround KB (to address advisory)

Please leave the comment