VMware vRealize Operations Manager vulnerabilities

8 CVEs affecting VMware vRealize Operations Manager, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22027, published 2021-08-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-21975: VMware Server Side Request Forgery in vRealize Operations Manager API, published 2021-03-31. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-01-18. EPSS: 78% chance of exploitation in the next 30 days. Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network access to the vRealize Operations Manager API can perform a…
CVE-2021-21983, published 2021-03-31. Medium severity, CVSS 6.5. EPSS: 68.8% chance of exploitation in the next 30 days. Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager…
CVE-2021-22027, published 2021-08-30. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations…
CVE-2021-22022, published 2021-08-30. Medium severity, CVSS 4.9. EPSS: 1.1% chance of exploitation in the next 30 days. The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability. A malicious actor with administrative access to vRealize Operations Manager API can read any…
CVE-2021-22026, published 2021-08-30. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. An unauthenticated malicious actor with network access to the vRealize Operations…
CVE-2021-22024, published 2021-08-30. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network access to the vRealize Operations Manager API…
CVE-2021-22023, published 2021-08-30. High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days. The vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference vulnerability. A malicious actor with administrative access to vRealize Operations Manager API may be able to…
CVE-2021-22025, published 2021-08-30. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. An unauthenticated malicious actor with network access to…