CVE-2021-45810: Globalprotect-Openconnect Project Globalprotect-Openconnect

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

GlobalProtect-openconnect versions prior to 2.0.0 (exclusive) are affected by incorrect access control in GPService through DBUS, GUI. The way GlobalProtect-Openconnect is set up enables arbitrary users to start a VPN connection to arbitrary servers. By hosting an openconnect compatible server, the attack can redirect the entire host's traffic via their own server.

Affected products

• Globalprotect-Openconnect Project Globalprotect-Openconnect: affected versions not specified

Published 2022-03-22. Last modified 2026-06-17.