CVE-2021-45809: Globalprotect-Openconnect Project Globalprotect-Openconnect

Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days.

GlobalProtect-openconnect versions prior to 1.4.3 are affected by incorrect access control in GPService through DBUS, GUI Application. The way GlobalProtect-Openconnect is set up enables arbitrary users to execute commands as root by submitting the `--script=<script>` parameter.

Affected products

• Globalprotect-Openconnect Project Globalprotect-Openconnect: before 1.4.3 (fixed in 1.4.3)

Published 2022-03-22. Last modified 2026-06-17.