Citrix ShareFile: Citrix ShareFile Improper Access Control Vulnerability

Who cares

citrix-sharefile, ransomware, self-hosted

Not affected if

managed-hosting, no-storage-zones-controller

1. CISA KEV2026-10-23 19:11 UTC · published 2022-03-25 00:00 UTC · CVE-2021-22941
2. EPSS2026-10-23 19:13 UTC · CVE-2021-22941
3. InfraStack analyst2026-10-23 21:20 UTC · published 2026-10-23 21:20 UTC
   “Fixed 5.11.20 per CERT-EU relaying Citrix CTX328123, CVE record, Helient. Citrix page itself unreadable (empty fetch). No public IOCs or PoC found; exploitation per CISA KEV (ransomware use per KEV flag, not verified).”
4. NVD2026-10-23 21:57 UTC · published 2021-09-23 13:15 UTC · CVE-2021-22941

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

• CISA KEV: CVE-2021-22941 · 10-23 19:11
• EPSS: CVE-2021-22941 · 10-23 19:13
• NVD: CVE-2021-22941 · 10-23 21:57
• CERT-EU 2021-050: Critical vulnerability in Citrix ShareFile (relays CTX328123)Advisory · InfraStack analyst
• CVE Record CVE-2021-22941 (references CTX328123)Describes it · InfraStack analyst
• Helient: ShareFile SZC security update (quotes Citrix: cloud-managed zones not affected)Fix · InfraStack analyst

This page as .md · .json · in your agent: get_signal("CVE-2021-22941")

CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.