VMware has fixed a serious flaw in its vCenter Server VMware utility that could have opened the door for hackers to remotely execute code on a vulnerable server.

In a press release published Wednesday, Positive Technologies, which discovered and alerted VMware to the bug, said attackers could have exploited the vCenter Server bug to take over unpatched VMware servers and gain access to local network resources.

The major threat would have come from hackers who had penetrated the security of a network perimeter through social engineering or web vulnerabilities, or who had gained access to a network using previously created backdoors.

Last August, Positive Technologies revealed the results of penetration testing through which it was able to breach the network perimeter and obtain access to local network resources in 93% of companies. In the press release, Positive Technologies analyst Mikhail Klyuchnikov explained how the VMware vulnerability could have been abused by any unauthorized user, making it especially dangerous.

“The error allows an unauthorized user to send a specially crafted request, which will later give them the opportunity to execute arbitrary commands on the server,” Klyuchnikov said.

“After receiving such an opportunity, the attacker can develop this attack, successfully move through the corporate network, and gain access to the data stored in the attacked system (such as information about virtual machines and system users),” he added. “If the vulnerable software can be accessed from the Internet, this will allow an external attacker to penetrate the company’s external perimeter and also gain access to sensitive data.”

This remote code execution (RCE) flaw specifically affects the vSphere Client (HTML5), which is a plugin for the vCenter Server used by many large companies to manage their local VMware product installations. Dubbed CVE-2021-21972, the flaw has earned itself has a CVSS v3 score of 9.8, indicating the severity of the problem.

More than 6,000 VMware vCenter devices worldwide contain the vulnerability, according to Positive Technologies. Even though 90% of them are located within the network perimeter, some of them are accessible remotely via the internet. A quarter of these devices are in the U.S., followed by smaller numbers in Germany, France, China, Great Britain, Canada, Russia, Taiwan, Iran and Italy.

Another vulnerability (CVE-2021-21973 with a CVSS score of 5.3) discovered by Positive Technologies could have allowed unauthorized users to send requests as the targeted server. By thus exploiting the flaw this way, an attacker could then scan a company’s internal network and find details about the open ports of various services.

Companies that use VMware Server are strongly urged to check VMware’s advisory page for more details on these flaws and to download and install the necessary updates to patch their systems. Further, Positive Technologies advises companies to remove vCenter Server interfaces from their perimeters if they are located as such and allocate them to a separate VLAN with a limited access list in the internal network.

“Exploitation simplicity and the impact of the vulnerability are both highly critical, permitting even unskilled attackers to take control over entire corporate networks within minutes,” Ilia Kolochenko, CEO of security provider ImmuniWeb, told TechRepublic. “It is, however, fair to say that normally vSphere Client web interface should not be accessible from the internet or at least should have strict IP filtering rules. Therefore, compromised organizations undoubtedly share responsibility for being breached via this vulnerability.”

VMware’s Push Into Telco Cloud

In the summer of 2019, VMware made three back-to-back startup acquisitions aimed squarely at accelerating what the industry calls “telco cloudification” — the migration of traditional, hardware-bound network functions onto agile, software-defined cloud infrastructure. The three companies acquired were Avi Networks, Bitfusion, and Uhana, each addressing a distinct challenge in modernizing telecom networks.

Shekar Ayyar, VMware’s executive vice president and general manager of telco and edge cloud, explained to Light Reading that the common thread across all three deals is positioning VMware as a stronger partner for telcos moving network control to a cloud architecture.

Breaking Down the Three Acquisitions

1. Avi Networks: Extending NSX to Layer 4–7

Avi Networks, acquired in July 2019, builds a virtualized application delivery controller (ADC). In networking terms, an ADC operates at OSI Layers 4 through 7 — the transport and application layers that sit above basic network routing and switching.

For VMware, Avi extends the reach of its NSX networking platform into these higher layers. For telcos specifically, this means:

• Placing virtual network functions (VNFs) at the optimal location within a telco cloud
• Load-balancing VNFs to deliver the best performance and latency
• Managing large volumes of simultaneous events at scale

Avi Networks is relevant to both VMware’s enterprise and telco business lines, given that application delivery and load balancing are universal infrastructure concerns.

2. Bitfusion: GPU Workload Orchestration

Bitfusion tackles a different problem: extending VMware’s ESX hypervisor architecture — which traditionally manages workloads on x86 CPUs — to support Graphics Processing Units (GPUs).

GPUs are increasingly critical for workloads that go well beyond gaming and graphics rendering, including:

• AI and machine learning inference
• Video processing at telco scale
• Radio Access Network (RAN) functions that require real-time media processing

By intelligently routing workloads to the best available GPU — whether on a local server or across a network — Bitfusion helps VMware provide technology that enables telcos to deliver video services more efficiently and optimize their RANs. Like Avi, Bitfusion has broader enterprise applicability beyond telecom.

3. Uhana: AI-Driven Mobile Network Optimization

Uhana is the most telco-specific of the three acquisitions. The company uses artificial intelligence to optimize RAN performance — a capability that is directly tied to the quality of mobile network experience for end users.

As telcos face mounting pressure to improve network efficiency ahead of and during 5G rollouts, AI-driven RAN optimization represents a meaningful technical differentiator. Uhana gives VMware a purpose-built tool for this use case rather than requiring telcos to adapt generic analytics platforms.

VMware’s Acquisition Playbook: A Pattern of Building Through Buying

These three deals fit a recognizable pattern in VMware’s history of building out its networking and infrastructure portfolio through acquisitions:

• Nicira (2012) — Acquired for more than $1 billion, this SDN pioneer became the foundation of VMware’s NSX software-defined networking platform, now a core part of the business.
• VeloCloud (2017) — Acquired for approximately $449 million, this SD-WAN startup is now integral to VMware’s WAN edge strategy.
• Avi Networks, Bitfusion, Uhana (2019) — Terms were not disclosed, and these deals are smaller in scale. However, they represent targeted capability additions rather than platform-level bets.

VMware also indicated at the time that its acquisition appetite was not yet satisfied, with Ayyar signalling continued interest in companies that could improve VMware’s intelligence, manageability, and security capabilities.

Why Telcos Are Looking Beyond Traditional Vendors

VMware’s telco push arrives at a moment of significant structural stress in the network equipment market. Telcos have historically relied on a small group of large incumbents — Huawei, Ericsson, and Nokia — for core networking gear. By 2019, each of those vendors faced serious headwinds:

• Huawei was facing intensifying geopolitical pressure, particularly restrictions tied to US-China trade tensions, creating uncertainty about its long-term viability as a trusted supplier in Western markets.
• Nokia and Ericsson were both navigating financial challenges and margin pressures in their infrastructure businesses.

The result is that network operators worldwide have been motivated to reduce their dependency on any single vendor and explore software-defined, cloud-native alternatives — which is precisely the space VMware is targeting.

VMware CEO Pat Gelsinger publicly described the telco opportunity as “enormous” during a keynote at VMworld, signalling that this was a strategic priority from the top of the organization, not an opportunistic side effort.

What This Means for Network Engineers and Architects

For engineers working at the intersection of cloud infrastructure and telecommunications, VMware’s 2019 acquisitions point to several practical directions:

• VNF placement and orchestration is becoming a first-class concern, not an afterthought. Avi-style Layer 4–7 intelligence is necessary to make cloud-native network functions perform reliably.
• GPU-accelerated workloads are moving into the network fabric, not just the data center AI cluster. RAN virtualization and real-time media processing are genuine GPU use cases in telco environments.
• AI for network operations (AIOps in the RAN context) is graduating from research projects to production acquisitions — signalling maturity in the tooling available to operators.
• The market is moving toward disaggregated, software-defined infrastructure, reducing reliance on vertically integrated hardware stacks from single vendors.

Summary

VMware’s three 2019 acquisitions — Avi Networks for Layer 4–7 application delivery, Bitfusion for GPU workload orchestration, and Uhana for AI-driven RAN optimization — represent a coherent, targeted strategy to make VMware’s platform relevant to telco cloud transformation. Backed by a track record that includes Nicira and VeloCloud, and driven by genuine market demand from operators seeking alternatives to a shrinking pool of traditional vendors, VMware’s telco cloudification push reflects both a technical and commercial opportunity that extends well beyond its enterprise roots.