Three weeks after releasing patches for a critical vulnerability in VMware vCenter, thousands of servers that are reachable from the internet remain vulnerable to attacks. VMware vCenter is used by enterprises to manage virtual machines, the VMware vSphere cloud virtualization solution, ESXi hypervisors, and other virtualized infrastructure components.

Remote code execution and authentication bypass
On May 25, VMware published a critical advisory and released patches covering two serious vulnerabilities that stem from the use of VMware vCenter plug-ins. The first vulnerability, tracked as CVE-2021-21985, is caused by improper input validation in the Virtual SAN (vSAN) Health Check plug-in that’s enabled by default in vCenter Server.

VMware vSAN is used for storage virtualization, but even if the plug-in is not actively used, the presence of the plug-in on the server is enough to enable attacks. A hacker with access to the server over port 443 (HTTPS) can exploit this issue without authentication to execute commands with unrestricted privileges on the operating system that hosts vCenter Server versions 6.5, 6.7 and 7.0, as well as VMware Cloud Foundation 3.x and 4.x, which include vCenter Server.

The second vulnerability, tracked as CVE-2021-21986, is rated as medium severity and impacts the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager and VMware Cloud Director Availability plug-ins. Attackers with access to a server over port 443 can perform actions allowed by the affected plug-ins without authentication.

Publicly exposed VMware servers
Researchers from security firm Trustwave recently performed a scan using SHODAN and identified 5,271 instances of VMware vCenter Server that are configured to be accessible from the internet. The vast majority of them (5,076) operate over port 443.

The researchers managed to connect to 4,969 of those servers and download information from their greeting banner, which includes more details about the specific version of the server such as build number and underlying operating system. The collected information revealed that 4,019, or 80.88%, of the scanned servers had not yet been patched for these flaws and that most of the remaining ones are running much older versions of the software that are considered end-of-life and are likely vulnerable to a variety of older issues.

If the ratio of unpatched servers is so high among publicly accessible servers, which are generally easier to attack and should be carefully monitored, it’s fair to assume that many vCenter Servers remain unpatched on private networks. However, attackers have many ways of gaining access to corporate networks, so attacking such servers would not be hard.

Proof-of-concept exploits and urgent need to patch
Since the patches were released in May, security researchers have developed and published proof-of-concept exploits for these issues, so potential attackers don’t have to spend much effort to start exploiting these issues in the wild. VMware warned users from the start that these vulnerabilities need to be patched as soon as possible and even published manual workarounds that involve editing the compatibility-matrix.xml file to disable the vulnerable plug-ins.

“If you ARE a vSAN customer, disabling the vSAN plugin will remove all ability to manage vSAN,” VMware said in a blog post. “No monitoring, no management, no alarms, nothing. This might be fine for your organization for very short periods of time but we at VMware cannot recommend it. Please use caution.”

“In this era of ransomware it is safest to assume that an attacker is already inside the network somewhere, on a desktop and perhaps even in control of a user account, which is why we strongly recommend declaring an emergency change and patching as soon as possible,” the company said.

VMWare is urging users to apply a patch to address two critical vulnerabilities in VMware vCenter and VMware Cloud Foundation to fix remote code execution and authentication vulnerabilities.

According to the company’s advisory, multiple vulnerabilities in the vSphere Client were privately reported to VMware., including remote code execution vulnerability in the vSphere Client due to a lack of input in the Virtual SAN Health Check plug-in, which is enabled by default in the vCenter Server.

“VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8,” the company said in its advisory.

The company also published a blog on the vulnerabilities, saying users of vCenter Server version 6.5, 6.7 and 7.0 need to apply the updates immediately.

“These updates fix a critical security vulnerability, and it needs to be considered at once. Organizations that practice change management using the ITIL definitions of change types would consider this an “emergency change.” All environments are different, have different tolerance for risk, and have different security controls & defense-in-depth to mitigate risk, so the decision on how to proceed is up to you. However, given the severity, we strongly recommend that you act.”

With access to port 443, a malicious actor can exploit the vulnerability to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server, VMware said.

According to the company’s blog, the remote code execution vulnerability in the vSAN plugin – which ships as part of vCenter Server – can be used by anyone who can reach vCenter Server over the network to gain access, regardless of whether a vSAN is used or not.

A second vulnerability in the vSphere Client could allow a malicious actor with access to port 443 on vCenter Server to perform actions allowed by the impacted plug-ins without authentication.

The update also improves the vCenter Server plugin framework to better enforce plugin authentication. This could cause some third-party plugins to stop working, VMware says.

If your IT department can’t patch right away and don’t use vSAN, there are workarounds for disabling the plugins affected. That involves editing a text file on the VCSA and restarting services.

However, the company cautions putting off the patch – especially as ransomware attacks increase.

“In this era of ransomware it is safest to assume that an attacker is already inside the network somewhere, on a desktop and perhaps even in control of a user account, which is why we strongly recommend declaring an emergency change and patching as soon as possible.”

Dell Technologies announced a broad set of infrastructure solutions and integrations for VMware environments, targeting workloads spanning the edge, data centre and hybrid cloud. The announcements coincided with VMware releasing updates to vSphere, vSAN and VMware Cloud Foundation (VCF) — all updated to support VMware Tanzu and its Kubernetes-based application platform.

VxRail: First HCI System Integrated with vSphere with Tanzu

Dell EMC VxRail — a hyperconverged infrastructure (HCI) system jointly engineered with VMware — was announced as the first system to be integrated with VMware vSphere with Tanzu. This integration enables customers to adopt Kubernetes with automated deployment and provisioning, available through:

• A validated architecture
• A VxRail cluster
• The Dell Technologies Cloud Platform (DTCP)

The Dell Technologies Cloud Platform also offers a subscription for VMware Tanzu in hybrid cloud environments, priced starting at USD $70 per node, per day.

Storage Innovations: PowerMax and ObjectScale

PowerMax Replication and Cloud Mobility

Dell EMC PowerMax replication has been integrated with two key VMware storage technologies:

• VMware vSphere Virtual Volumes (vVols) — enabling storage policy-based management directly from vSphere
• VMware Site Recovery Manager — streamlining provisioning, replication and service-level policy management

A new Cloud Mobility for Dell EMC PowerMax feature enables the movement of data from on-premises storage to public clouds. According to Dell, this can reduce the cost per GB for long-term data retention by up to 50%, while freeing PowerMax capacity for higher-priority on-premises applications and extending the useful life of the array. The release also includes improved security features and Smart DR for data resiliency.

Dell EMC ObjectScale: Kubernetes-Native Object Storage

Dell EMC ObjectScale is Dell’s next-generation, Kubernetes-based object storage platform. At the time of announcement it was available through an early access programme. Key characteristics include:

• S3-compatible storage — developers can provision cloud-scale object storage on demand for modern stateful applications
• vSphere-native deployment — object storage can be deployed directly through vSphere, aligning development and IT operations workflows
• Geo-distributed architecture — a scale-out design with global accessibility supports edge, core data centre and hybrid cloud environments

Data Protection: PowerProtect Data Manager Updates

Dell Technologies introduced several data protection enhancements to PowerProtect Data Manager specifically for VMware environments:

• Tanzu portfolio support — PowerProtect Data Manager now supports Tanzu Kubernetes clusters, Kubernetes clusters in vSphere, Tanzu Kubernetes Grid (TKG) and Tanzu Kubernetes Grid Integrated (TKGI), both on-premises and in public clouds.
• vCenter Storage Policy-Based Management (SPBM) integration — VI admins can assign data protection policies using familiar vSphere workflows, without leaving their existing toolset.
• VMware Cloud Foundation protection — this release provides a VMware-certified solution for protecting the VCF infrastructure layer.
• Disruption-free VM backups (preview) — Dell previewed a new capability using snapshot and data movement technologies that eliminates the need to pause a VM during backup, allowing mission-critical virtual machines to remain active and available throughout the backup process.

Cloud Building: VMware Cloud Director and DTCP Integration

To help cloud service providers (CSPs) build and scale hosted cloud environments more efficiently, Dell and VMware announced tighter integration between VMware Cloud Director and the Dell Technologies Cloud Platform (DTCP). The benefits cited include:

• Reduced time to provision and manage multi-tenant cloud environments
• Ability to create virtual data centres in minutes, with deployment in seconds across multiple locations
• New automation capabilities for service deployment and lifecycle management of the software-defined data centre
• CSPs running VMware Cloud Director on DTCP can provide customers with rapid, consistent access across DTCP environments and off-premises instances

Support for VMware Project Monterey

Dell Technologies announced its support for VMware Project Monterey, VMware’s initiative to redesign data centre architecture in response to how modern applications are built and deployed. Project Monterey focuses on offloading and disaggregating infrastructure services — including networking, security and storage — to SmartNICs and DPUs (Data Processing Units), freeing CPU resources for application workloads.

Dell’s involvement signals that future generations of Dell EMC PowerEdge servers are expected to be aligned with this architectural direction, though specific product details were not disclosed at the time of announcement.

Summary

These announcements represent a significant expansion of Dell’s VMware integration strategy, with updates touching HCI (VxRail), primary storage (PowerMax), object storage (ObjectScale), data protection (PowerProtect Data Manager) and cloud platform services (DTCP). The common thread is deeper Kubernetes and Tanzu support across Dell’s portfolio, alongside automation improvements for both enterprise IT teams and cloud service providers.

For organisations running VMware-based infrastructure on Dell hardware, these integrations reduce the operational friction of adopting container-based workloads alongside traditional VM workloads, and extend data protection and mobility capabilities into hybrid and multi-cloud scenarios.