VMware vCenter SDK API Probe for 2026-06-04
Jun 04, 2026
WebExploit
Last Updated: 12:00 UTC
/sdk is the vCenter Managed Object Browser and SOAP API endpoint. CVE-2021-22005 (file upload RCE via analytics service) and CVE-2021-21985 (vSphere Client plugin RCE) both achieve unauthenticated code execution against the vCenter management plane.
CVE References
MITRE ATT&CK
Tactic: Initial Access (TA0001)
Technique: T1190 — Exploit Public-Facing Application
Observed URIs
Attackers by Country
| Germany | 2 | 40.0% |
| United States of America | 2 | 40.0% |
| Australia | 1 | 20.0% |
IP Address : ASN : City/Provider
-
167.172.169.112 : AS14061 digitalocean llc : Frankfurt am Main
-
172.105.177.106 : AS63949 linode llc : Sydney
-
64.226.90.149 : ASNone : United States of America
-
68.183.66.167 : AS14061 digitalocean llc : Frankfurt am Main
-
97.107.131.17 : AS63949 linode llc : Cedar Knolls