CVE-2021-21975

VMware's vRealize Operations Manager API had a critical SSRF vulnerability exploited in the wild, potentially leading to credential theft and system compromise.

A SSRF vulnerability in vRealize Operations Manager API (prior to 8.4) allowed network-accessible attackers to steal administrative credentials, actively exploited and linked to ransomware. DIB organizations using this product must immediately patch and review network access controls to prevent unauthorized access and potential data exfiltration, impacting CMMC/NIST 800-171 compliance.

Shame score — The SSRF vulnerability, coupled with active exploitation and potential for credential theft, demonstrates a significant security oversight with serious operational consequences.