{"id":"CVE-2021-22941","published":"2021-09-23T13:15:08Z","modified":"2026-06-17T03:38:04Z","title":"Citrix ShareFile Improper Access Control Vulnerability","vendor":"Citrix","product":"ShareFile","tier":"core","eol":null,"description":{"text":"Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compromise the storage zones controller.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the storage zones controller component of Citrix ShareFile, affecting versions before 5.11.20, stems from improper access control. An unauthenticated attacker with network access can remotely compromise the storage zones controller, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:02:26Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.53585,"percentile":0.9899,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-22941","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-03-07","exploitedFirstSeen":"2022-03-07","ransomware":true,"evidence":[{"url":"https://www.crowdstrike.com/blog/prophet-spider-exploits-citrix-sharefile/","date":"2022-03-07"},{"url":"https://socprime.com/blog/cve-2021-22941-citrix-sharefile-remote-code-execution-vulnerability-exploited-by-prophet-spider/","date":"2022-03-14"},{"url":"https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/2022-unit42-ransomware-threat-report-final.pdf","date":"2022-03-24"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"},{"url":"https://static.tenable.com/marketing/whitepapers/Whitepaper-Ransomware_Ecosystem.pdf","date":"2022-06-22"},{"url":"https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker","date":"2023-09-20"},{"url":"https://thehackernews.com/2023/09/cyber-group-gold-melody-selling.html","date":"2023-09-21"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2021-22941","date":"2025-06-08"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://support.citrix.com/article/CTX328123","tags":["Broken Link","Vendor Advisory"]},{"url":"https://support.citrix.com/article/CTX328123","tags":["Broken Link","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22941","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated remote exploitation of exposed public-facing application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"may allow an unauthenticated attacker to remotely compromise the storage zones controller","start":84,"end":173}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Compromise implies arbitrary code execution on controller","mappingType":"primary_impact","evidence":[{"from":"description","quote":"may allow an unauthenticated attacker to remotely compromise the storage zones controller","start":84,"end":173}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-10070","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-10070","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2021-10-12","earliestUrl":"https://github.com/hoav18/CVE-2021-22941","repos":[{"name":"hoav18/CVE-2021-22941","url":"https://github.com/hoav18/CVE-2021-22941","stars":13,"created":"2021-10-12"},{"name":"pratikjojode/citrix-cve-2021-22941-lab","url":"https://github.com/pratikjojode/citrix-cve-2021-22941-lab","stars":0,"created":"2025-12-02"}]},"first":{"date":"2021-10-12","source":"PoC-in-GitHub","url":"https://github.com/hoav18/CVE-2021-22941"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2021-09-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22941","provenance":"source"},{"date":"2021-10-12","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/hoav18/CVE-2021-22941","provenance":"source"},{"date":"2022-03-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.crowdstrike.com/blog/prophet-spider-exploits-citrix-sharefile/","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-10070","provenance":"source"}],"speed":{"daysToPublicExploit":19,"firstExploitFrom":"PoC-in-GitHub","daysToKev":183},"priority":{"score":79.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1697 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.8,"detail":"percentile 0.9899"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}