See our Managed Services and learn how we can help your firm.

VMware Cloud Foundation remote code execution vulnerability via XStream (CVE-2021-39144)

March 13, 2023

By Marc Caballero

Cornerstone.IT VMware Professional Solution Provider partner

CISA identified VMware products to the CVE-2021-39144 vulnerability in its Known Exploited Vulnerabilities (KEV) catalog following confirmation from VMware that this bug is being exploited since December 2022.

The flaw was found in the XStream open-source library used by VMware products.

XStream 1.4.18 and earlier versions have a deserialization vulnerability that received the Common Vulnerabilities and Exposures (CVE) number CVE-2021-39144. This vulnerability allows an attacker to manipulate the input stream for remote code execution in products that use the XStream library.

“Due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Foundation (NSX-V), a malicious actor can get remote code execution in the context of ‘root’ on the appliance,” VMware explains in their security advisory.

Affected Products

  • VMware Cloud Foundation 4.x
  • VMware Cloud Foundation (NSX-V) 3.11
  • VMware NSX Data Center for vSphere 6.4.14


VMware released security updates (see product response matrix) to mitigate the flawed components reported by Sina Kheirkhah of MDSec and Steven Seeley of Source Incite last October 2022.

In addition, VMware issued patches for end-of-life versions of Cloud Foundation Network Security Virtualization for vSphere (NSX-V) to address a critical vulnerability in the Xstream open-source library.


Contact Cornerstone.IT for assistance remediating this issue. If you are a small or mid-sized law firm, Cornerstone.IT’s dedicated 24/7 Network Operations Center (NOC) can help you with future patches, monitoring, and other mundane tasks that keep you from focusing on moving your firm forward.