On May 25, 2021, VMware released a new critical security advisory, VMSA-2021-0010 (CVE-2021-21985 & CVE-2021-21986), affecting vCenter Server 6.5, 6.7, and 7.0. These vulnerabilities could allow a malicious actor to gain access to vCenter by exploiting the vSAN plugin, even if vSAN is not currently in use. VMware has also made improvements to the vCenter Server plugin framework to better enforce plugin authentication and prevent this type of vulnerability in the future.
Avertium strongly encourages you to implement the software patch PME version 1.1.15 to preemptively mitigate this software flaw and utilize the most up-to-date cybersecurity measures to protect your patch management infrastructure.
Depending on the needs of the business, consider any serious long-term probing attempts on your assets to reveal a potential threat.
Contact us for more information about Avertium’s managed security service capabilities.