CVE-2021-22021: VMware Cloud Foundation

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An attacker with user privileges may be able to inject a malicious payload via the Log Insight UI which would be executed when the victim accesses the shared dashboard link.

Affected products

• VMware Cloud Foundation: from 4.0, before 4.3 (fixed in 4.3)
• VMware vRealize Log Insight: from 4.0, up to and including 4.8; from 8.0.0, before 8.4 (fixed in 8.4)

Published 2021-08-30. Last modified 2026-06-17.