CVE-2021-21998 is a critical authentication bypass vulnerability affecting VMware Carbon Black App Control versions 8.0, 8.1, 8.5 (prior to 8.5.8), and 8.6 (prior to 8.6.2). This flaw allows an unauthenticated attacker with network access to the management server to gain administrative control over the product. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, the vulnerability has garnered significant media attention and community discussion, though no public exploit code (Metasploit, Nuclei, ExploitDB) has been identified.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.5, < 8.5.8CPE matchmatch criteria | cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:* | ||
>= 8.6, < 8.6.2CPE matchmatch criteria | cpe:2.3:a:vmware:carbon_black_app_control:*:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:a:vmware:carbon_black_app_control:8.0:*:*:*:*:*:*:* | ||
8.1CPE matchmatch criteria | cpe:2.3:a:vmware:carbon_black_app_control:8.1:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.