CVE-2021-27900: Proofpoint Insider Threat Management

High severity, CVSS 8.1. EPSS: 2.5% chance of exploitation in the next 30 days.

The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web Console. This enables a view-only user to change any configuration setting and delete any registered agents. All versions before 7.11.1 are affected.

Affected products

• Proofpoint Insider Threat Management: from 7.9.0, before 7.9.3 (fixed in 7.9.3); from 7.10.0, before 7.10.3 (fixed in 7.10.3); from 7.11.0, before 7.11.1 (fixed in 7.11.1)

Published 2021-04-06. Last modified 2026-06-17.