CVE-2021-22042: VMware Cloud Foundation

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within the VMX process only, may be able to access settingsd service running as a high privileged user.

Affected products

• VMware Cloud Foundation: from 4.0, before 4.4 (fixed in 4.4)
• VMware ESXi: version 7.0 only

Published 2022-02-16. Last modified 2026-06-17.