CVE-2021-22048: VMware Cloud Foundation

High severity, CVSS 8.8. EPSS: 10.3% chance of exploitation in the next 30 days.

The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group.

Affected products

• VMware Cloud Foundation: from 3.0, up to and including 3.10.2.2; from 4.0, up to and including 4.1.0.1
• VMware vCenter Server: version 6.5 only; version 6.7 only; version 7.0 only

Published 2021-11-10. Last modified 2026-06-17.