CVE-2021-22005: VMware vCenter Unauthenticated File Upload RCE

vCenter Server's CEIP telemetry collection exposes an HTTP API endpoint intended for internal analytics data submission. The vulnerable path — /analytics/telemetry/ph/api/hyper/send — accepted multipart file uploads without requiring any form of authentication.

By sending a crafted multipart HTTP POST to this endpoint, an attacker could upload an arbitrary file to a location on the vCenter server's filesystem. Uploading a JSP (JavaServer Pages) file to a web-accessible directory — readily identifiable via vCenter's publicly documented directory structure — allowed immediate code execution by issuing a subsequent HTTP request to the uploaded file.

The vCenter services run with elevated system privileges on the underlying operating system (Photon OS, VMware's custom Linux). Code execution through the JSP webshell carried those same privileges, providing broad access to the hypervisor management layer, credential stores, and all vCenter API functionality.

Several converging factors made rapid mass exploitation certain:

**Zero authentication barrier**: The vulnerable endpoint required no credentials — just network connectivity to port 443.

**Documented file layout**: vCenter's web root directory structure is publicly documented in VMware's administration guides, making webshell placement trivial.

**Approximately 6,700 internet-exposed instances**: Shodan and Censys scans revealed thousands of vCenter servers directly accessible from the internet at time of disclosure.

**Extreme target value**: vCenter is the management plane for virtualized infrastructure. Ransomware operators specifically prize vCenter access because encrypting VMware datastore files disables thousands of VMs in a single operation. Espionage actors value it for the breadth of network access it provides.

The exploitation sequence from initial access to infrastructure control:

CISA's Emergency Directive 21-04 and subsequent reporting documented the following post-exploitation patterns:

**Cryptocurrency mining**: Multiple campaigns deployed XMRig and similar miners using vCenter compute resources — the lowest-sophistication but most immediately monetizable outcome.

**Ransomware pre-positioning**: Sophisticated operators used initial access to establish persistence and conduct reconnaissance before deploying ransomware against the virtualization layer. A single ransomware execution targeting VMware datastores could render thousands of VMs unbootable.

**Persistent webshells**: Nation-state-adjacent actors planted minimal webshells and maintained long-term dwell time for intelligence collection rather than immediately destructive operations.

**Credential harvesting**: The vCenter configuration database and SSO token stores contain credentials providing access to every VM managed by the instance and often to connected cloud environments.

Indicators for CVE-2021-22005 exploitation and post-compromise activity:

Steps in order of urgency:

CVE-2021-22005 demonstrates that the virtualization management plane is among the highest-value targets in any enterprise — and among the most catastrophically impactful when compromised. A single unauthenticated HTTP request gave attackers root on a system controlling every workload in the datacenter. vCenter should never be internet-accessible. If it was before September 21, 2021, treat it as compromised until a thorough forensic review proves otherwise.