Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2021-1498

CVE-2021-1498CRITICAL

Cisco HyperFlex HX Command Injection Vulnerabilities

  AV  AC  PR  UI  S  C  I  A   CVSS     EPSS    %ile   KEV
   N   L   N   N  U  H  H  H    9.8   1.0000   100.0   YES

AFFECTED
  Product                           Versions  Fixed
  Cisco HyperFlex HX Data Platform  n/a –     —

TIMELINE
  Nov 13  Reserved by cisco
  May 6   Published (CNA: cisco)
  Nov 3   Added to CISA KEV, remediation due 2021-11-17

CWE-78 · CNA: cisco · CVSS v3.1 · 3 references · KEV due November 17, 2021

Description

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
November 13, 2020	Reserved	Reserved by cisco
May 6, 2021	Published	Published (CNA: cisco)
November 3, 2021	KEV ADDED	Added to CISA KEV, remediation due 2021-11-17

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Cisco	Cisco HyperFlex HX Data Platform	—	n/a	—

Weaknesses

CWE-78

References (3)

http://packetstormsecurity.com/files/162976/Cisco-HyperFlex-HX-Data-Platform-Command-Execution.html [x_refsource_MISC]
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-rce-TjjNrkpR [vendor-advisory, x_refsource_CISCO]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1498 [government-resource]

Authoritative record: CVE-2021-1498 at cve.org

Vendors: cisco

Weaknesses: CWE-78

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-1498 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.