CVE-2021-22908

What it actually does

This vulnerability is a network-reachable buffer overflow in the Windows File Resource Profiles functionality of Ivanti Connect Secure / Pulse Secure Pulse Connect Secure 9.x. An authenticated remote user who has privileges to browse SMB shares can trigger memory corruption and execute arbitrary code with root privileges on the appliance. Because the vulnerable component runs with high privileges, successful exploitation can result in full compromise of the VPN appliance, including confidentiality, integrity, and availability impact.

Why it matters to the business

A compromised VPN appliance can give an attacker a powerful foothold at the network edge, potentially allowing theft of credentials and session data, tampering with VPN configuration, disruption of remote access, and pivoting into internal systems. The risk is elevated because the vulnerability has a high CVSS score and a high EPSS probability, meaning exploitation is plausible where vulnerable functionality and permissions are present, even though it is not listed in CISA KEV and is not known here to be ransomware-associated. Organizations using affected 9.x versions should treat exposed appliances as high-priority assets because they often protect remote workforce and third-party access.

How an attack unfolds

An attacker first obtains valid credentials for the VPN portal, either through phishing, credential reuse, password spraying, or compromise of an existing account. The account must have privileges to browse SMB shares through Windows File Resource Profiles; starting with version 9.1R3 this permission is not enabled by default, which may reduce exposure on newer hardened deployments. Once authenticated, the attacker accesses the vulnerable SMB browsing functionality and sends specially crafted input that exceeds expected buffer boundaries. If exploitation succeeds, the appliance process memory is corrupted in a controlled way, allowing the attacker to run code as root. From that position, the attacker can modify appliance files or configuration, harvest credentials or sessions, install persistence, intercept traffic, or use the appliance as a staging point for internal reconnaissance.

How to fix it

Upgrade affected Ivanti Connect Secure / Pulse Secure Pulse Connect Secure 9.x appliances to a vendor-supported fixed release as provided by Ivanti/Pulse Secure guidance for CVE-2021-22908. No exact fixed versions were provided in the input, so administrators should consult the vendor advisory and release notes for the applicable supported branch. As mitigation until patching is complete, restrict VPN administrative and user access to trusted networks where possible, disable or remove Windows File Resource Profiles and SMB browsing permissions for users who do not require them, verify that SMB share browsing is not enabled by default on 9.1R3 and later unless explicitly needed, enforce MFA for VPN users, remove dormant accounts, and monitor for suspicious authenticated use of file browsing features. If compromise is suspected, rebuild or factory-reset the appliance from trusted media after collecting forensic evidence, rotate credentials and keys that may have traversed or been stored on the appliance, and review connected identity stores and downstream systems for follow-on activity.

How to confirm the fix worked

Confirm the appliance product and version are not in the vulnerable 9.x range or have been upgraded according to the vendor advisory. Review configuration to verify Windows File Resource Profiles are disabled unless required and that only explicitly authorized users can browse SMB shares. Test with a low-privilege account to ensure SMB browsing permissions are not broadly available. Validate that the appliance is running a supported fixed release from the administrative console or CLI and that all nodes in any cluster are updated. Run an authenticated vulnerability scan or vendor integrity checker where available, and review change records to ensure the mitigation or patch was applied to every exposed appliance. After remediation, verify VPN authentication, SMB resource profile access, and logging still function as expected without exposing unnecessary file-browsing capability.

Typical attack path

1. Identify an internet-facing Ivanti Connect Secure / Pulse Secure Pulse Connect Secure 9.x appliance.
2. Obtain valid VPN credentials through phishing, reuse, spraying, brokered access, or prior compromise.
3. Confirm the authenticated account can browse SMB shares via Windows File Resource Profiles.
4. Send a crafted request to the vulnerable SMB browsing/resource-profile functionality to trigger the buffer overflow.
5. Gain arbitrary code execution with root privileges on the appliance.
6. Establish persistence or deploy tooling on the appliance.
7. Collect credentials, session artifacts, configuration data, or network information.
8. Pivot from the VPN appliance toward reachable internal systems or disrupt VPN services.

How to detect it

Investigate whether authenticated users accessed Windows File Resource Profiles or SMB share browsing in unusual ways, especially shortly before crashes, service restarts, configuration changes, or unexplained appliance behavior. Useful sources include VPN authentication logs, user access logs, web/request logs for file resource profile features, SMB resource access logs, administrative audit logs, system/process logs from the appliance, crash/core dump records, and network telemetry showing SMB connections initiated by the appliance. Look for low-privilege or unexpected users browsing SMB shares, repeated malformed or unusually long resource path inputs, appliance process crashes followed by successful access, new or modified files on the appliance, unexpected outbound connections, new scheduled/persistent tasks, and configuration changes not tied to approved administration. Because no public exploit indicators were provided, detection should focus on behavior: authenticated access to the vulnerable feature followed by signs of memory corruption, privilege escalation, or post-exploitation activity. If threat hunting finds suspicious activity, correlate the user account, source IP, time of SMB browsing, appliance restarts/crashes, and subsequent internal network connections from the appliance.

• Windows File Resource Profiles
• SMB share browse
• SMB browsing
• core dump
• segmentation fault
• buffer overflow
• process crashed
• service restart
• /data/runtime/mt/
• /home/runtime/mt/
• /tmp/
• /var/tmp/
• /etc/passwd
• /etc/shadow

What your security team should do

• Prioritize inventory of all Ivanti Connect Secure / Pulse Secure Pulse Connect Secure 9.x appliances, especially internet-facing systems.
• Patch or upgrade affected appliances to a vendor-supported fixed release; if fixed-version mapping is unclear, obtain the relevant Ivanti advisory for the deployed branch.
• Immediately audit Windows File Resource Profiles and remove SMB browsing privileges from users and roles that do not require them.
• Require MFA for all VPN access and investigate accounts with unusual SMB browsing activity or failed exploitation-like requests.
• Review appliance logs, authentication logs, and SMB/file-resource access logs for suspicious authenticated activity before the patch date.
• If exploitation is suspected, treat the VPN appliance as a high-value compromised edge device: preserve evidence, isolate where feasible, rotate credentials, and rebuild from trusted media.
• Limit management interfaces and VPN portal exposure to trusted sources where operationally possible.
• Increase monitoring for post-compromise behavior such as new local files, unexpected processes, configuration changes, credential harvesting, or internal scanning from the VPN appliance.