VMware vCenter SDK API Probe for 2026-10-21
Last Updated: 00:00 UTC
/sdk is the vCenter Managed Object Browser and SOAP API endpoint. CVE-2021-22005 (file upload RCE via analytics service) and CVE-2021-21985 (vSphere Client plugin RCE) both achieve unauthenticated code execution against the vCenter management plane.
CVE References
MITRE ATT&CK
Tactic: Initial Access (TA0001)
Technique: T1190 — Exploit Public-Facing Application
Observed URIs
Attackers by Country
| France | 5 | 62.5% |
| Germany | 1 | 12.5% |
| United States | 1 | 12.5% |
| Seychelles | 1 | 12.5% |
IP Address : ASN : City/Provider
-
185.177.72.108 : AS211590 Bucklog SARL : France
-
185.177.72.113 : AS211590 Bucklog SARL : France
-
185.177.72.144 : AS211590 Bucklog SARL : France
-
185.177.72.236 : AS211590 Bucklog SARL : France
-
195.182.16.23 : AS206264 Amarutu Technology Ltd : Frankfurt am Main
-
20.44.126.226 : AS8075 Microsoft Corporation : Boydton
-
5.61.209.106 : AS206264 Amarutu Technology Ltd : Seychelles
-
77.132.88.57 : AS15557 Societe Francaise Du Radiotelephone - SFR SA : France