CVE-2021-22036: VMware vRealize Automation

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling. A malicious actor may be able to redirect victim to an attacker controlled domain due to improper path handling in vRealize Orchestrator leading to sensitive information disclosure.

Affected products

• VMware vRealize Automation: from 8.0, before 8.6 (fixed in 8.6)
• VMware vRealize Orchestrator: from 8.0, before 8.6 (fixed in 8.6)

Published 2021-10-13. Last modified 2026-06-17.