CVE-2021-22908: Ivanti Connect Secure

High severity, CVSS 8.8. EPSS: 69.4% chance of exploitation in the next 30 days.

A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3, this permission is not enabled by default.

Affected products

• Ivanti Connect Secure: version 9.0 only; version 9.1 only
• Pulse Secure Pulse Connect Secure: version 9.0rx only

Published 2021-05-27. Last modified 2026-06-17.