CVE-2021-27899: Proofpoint Insider Threat Management

High severity, CVSS 7.4. EPSS: 0.6% chance of exploitation in the next 30 days.

The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and Linux perform improper validation of the ITM Server's certificate, which enables a remote attacker to intercept and alter these communications using a man-in-the-middle attack. All versions before 7.11.1 are affected. Agents for Windows and Cloud are not affected.

Affected products

• Proofpoint Insider Threat Management: from 7.9.0, before 7.9.3 (fixed in 7.9.3); from 7.10.0, before 7.10.3 (fixed in 7.10.3); from 7.11.0, before 7.11.1 (fixed in 7.11.1)

Published 2021-04-06. Last modified 2026-06-17.