CVE-2021-22941: Citrix ShareFile storage zones controller improper access control

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 unauthenticated remote compromise, KEV listing with known ransomware use, and very high EPSS probability make this an urgent patch target.

What it is

Citrix ShareFile storage zones controller before 5.11.20 contains an improper access control flaw (CWE-284) that can let an unauthenticated attacker remotely compromise the controller. Because the controller sits in the storage path for ShareFile data, a compromise exposes the file storage infrastructure rather than a single user account.

Impact

An unauthenticated attacker can remotely compromise the storage zones controller, gaining high confidentiality, integrity and availability impact on that host. In practice this means control of the component that brokers access to stored ShareFile data.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet- or network-exposed storage zones controller instance is in scope.

Exploitation

Listed in CISA KEV since 2022-03-25 with known ransomware campaign use, and EPSS 30-day probability is about 0.536 (98.9th percentile), indicating active exploitation is expected. The vendor advisory reference is tagged as a broken link, so consult CISA KEV for the required action.

What to do

• Upgrade Citrix ShareFile storage zones controller to 5.11.20 or later as instructed by the vendor advisory.
• If immediate patching is not possible, remove the controller from direct internet exposure and restrict access to trusted networks.
• Verify the controller is not reachable from untrusted networks and review firewall or load balancer rules for unintended exposure.
• Rotate credentials and secrets used by the storage zones controller after patching, in case of prior compromise.
• Monitor CISA KEV for updated guidance and confirm remediation against the listed due date.

Detection

• Search web and proxy logs for anomalous requests to storage zones controller endpoints from unauthenticated or unexpected source IPs.
• Review controller and host logs for unexpected process creation, file writes, or configuration changes around the controller service.
• Hunt for signs of post-exploitation on controller hosts, including new accounts, scheduled tasks, or outbound connections to unfamiliar hosts.
• Inventory all storage zones controller instances and confirm version is 5.11.20 or later.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.