CVE-2021-26987: Netapp Element Plug-In For vCenter Server

Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days.

Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCenter Server, Management Services versions prior to 2.17.56 and Management Node versions through 12.2 contain vulnerable versions of SpringBoot Framework.

Affected products

• Netapp Element Plug-In For vCenter Server: any version
• Netapp Management Services For Element Software And Netapp Hci: before 2.17.56 (fixed in 2.17.56)
• Netapp Solidfire & Hci Management Node: up to and including 12.2
• VMware Spring Boot: before 1.3.2 (fixed in 1.3.2)

Published 2021-03-15. Last modified 2026-06-17.