Vulnerability record · CVE-2021-22908 · published 27 May 2021
CVE-2021-22908: Ivanti Pulse Connect Secure Windows File Resource Profiles buffer overflow
Ivanti · Connect Secure
A buffer overflow exists in the Windows File Resource Profiles feature of Pulse Connect Secure 9.x. A remote authenticated user who can browse SMB shares can trigger it to run code as root. The feature is not enabled by default as of 9.1R3, so exposure depends on configuration.
Description
A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. As of version 9.1R3, this permission is not enabled by default.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityRemote authenticated code execution as root on a VPN gateway is severe, and the very high EPSS score signals likely exploitation pressure despite no KEV listing.
What it is
A buffer overflow exists in the Windows File Resource Profiles feature of Pulse Connect Secure 9.x. A remote authenticated user who can browse SMB shares can trigger it to run code as root. The feature is not enabled by default as of 9.1R3, so exposure depends on configuration.
Impact
An attacker with SMB browse privileges gains arbitrary code execution as root on the appliance, giving full control of the VPN gateway and any credentials or sessions it handles.
Attack surface
Reached over the network via SMB share browsing through the Windows File Resource Profiles feature; the vector requires low privileges (an authenticated user) and no user interaction.
Exploitation
Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is very high (0.69377, 99.3rd percentile), indicating elevated predicted exploitation activity.
What to do
- Apply the vendor fix from Pulse Secure advisory SA44800 for the affected 9.x release.
- If patching is delayed, disable or restrict the Windows File Resource Profiles feature, which is off by default from 9.1R3.
- Limit SMB share browsing permissions to only the accounts that truly need it.
- Monitor and restrict outbound SMB traffic from the appliance to trusted file servers only.
- Review appliance accounts for unnecessary browse privileges and remove them.
Detection
- Alert on unexpected process creation or shell activity on the Connect Secure appliance.
- Monitor SMB traffic from the appliance to internal file servers for anomalous or malformed requests.
- Audit configuration changes that enable Windows File Resource Profiles.
- Review appliance logs for crashes or restarts of the file resource service.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-22908 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-22908), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
