CVE-2021-22908

CVSS 3.1: 8.8 high
EPSS: 69%p99
Published: May 27, 2021 · May 27, 2021
Modified: Jun 17, 2026

Analyze CVE-2021-22908 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3, this permission is not enabled by default.

Vendors: ivanti pulsesecure

Products: connect secure, pulse connect secure

Weakness: CWE-120

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (69.4%)

In the news

2 stories

Ivanti fixes high severity flaw in Pulse Connect Secure VPN

Security AffairsMay 25, 21:00 UTC · May 25, 2021VulnerabilityCVE-2021-229083 · 1 read

New High-Severity Vulnerability Reported in Pulse Connect Secure VPN

The Hacker NewsMay 25, 07:37 UTC · May 25, 2021VulnerabilityExploitedCVE-2021-22908 CVE-2021-22893 CVE-2021-22894+23 · 1 read