CVE-2021-27900

—

CVSS 3.1

8.1 high

EPSS

2%p83

Published

Apr 6, 2021 (Apr 6, 2021)

Modified

Jun 17, 2026

Description

The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web Console. This enables a view-only user to change any configuration setting and delete any registered agents. All versions before 7.11.1 are affected.

Vendors: proofpoint
Products: insider threat management
Weakness: CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.5%)

In the news0 stories

No ingested article mentions this CVE yet.