CVE-2021-22908

—

CVSS 3.1

8.8 high

EPSS

69%p99

Published

May 27, 2021 (May 27, 2021)

Modified

Jun 17, 2026

Description

A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3, this permission is not enabled by default.

Vendors: ivanti pulsesecure
Products: connect secure, pulse connect secure
Weakness: CWE-120
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (69.4%)

In the news2 stories

Ivanti fixes high severity flaw in Pulse Connect Secure VPN

Security AffairsMay 25, 21:00 UTC · May 25, 2021Vulnerability CVE-2021-22908

New High-Severity Vulnerability Reported in Pulse Connect Secure VPN

The Hacker NewsMay 25, 07:37 UTC · May 25, 2021Vulnerability in the wildCVE-2021-22908 CVE-2021-22893 CVE-2021-22894+2 CVEs