{"id":"CVE-2021-22941","kind":"vulnerability","aliases":["CVE-2021-22941"],"related":[],"title":"Citrix ShareFile: Citrix ShareFile Improper Access Control Vulnerability","description":"Improper Access Control in Citrix ShareFile storage zones controller may allow an unauthenticated attacker to remotely compromise the storage zones controller.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Improper access control (CWE-284) in self-hosted Citrix ShareFile storage zones controller before 5.11.20 lets an unauthenticated remote attacker compromise the controller. Listed in CISA KEV. Citrix-managed cloud storage zones are not affected.","severity":"critical","cvss":10.0,"epss":0.53585,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Citrix ShareFile","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Citrix ShareFile storage zones controller","fixed":["5.11.20"],"affected":"< 5.11.20","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["citrix-sharefile","exploited","ransomware","self-hosted","vendor"],"not_affected_if":["managed-hosting","no-storage-zones-controller"],"how_to_check":"Open the storage zones controller admin/config page or Windows installed programs and read the version; anything below 5.11.20 is vulnerable. Also check whether the controller is internet-facing. Citrix published no detection indicators; review IIS logs and the controller host for unexpected files or web shells.","fix":"Upgrade ShareFile storage zones controller to 5.11.20 or later (Citrix CTX328123). Until then restrict network access to the controller.","status":"open","published_at":"2021-09-23T13:15:08+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:20:05+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T21:20:05Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per Citrix guidance; exact fixed version not stated in sources.","reach":"internet","impact":"high","summary":"Citrix ShareFile storage zones controller has an improper access control flaw. An unauthenticated remote attacker can fully compromise the storage zones controller.","category":"vendor","who_cares":["citrix-sharefile","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker fully compromises the storage zones controller remotely","analyst_note":"Find Citrix's advisory and fixed ShareFile storage zones controller versions and detection indicators; sources list only KEV and EPSS links.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","no-storage-zones-controller"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000448,"input_tokens":2836,"output_tokens":328,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find Citrix's advisory and fixed ShareFile storage zones controller versions and detection indicators; sources list only KEV and EPSS links.","search":"'-2021':10A,13A '-22941':11A,14A '-284':35B '5.11.20':46B 'access':6A,32B,69C 'action':91C 'affect':67B 'allow':78C 'appli':92C 'attack':51B,81C 'cisa':57B,89C 'citrix':1A,3A,15A,17A,23B,40B,60B,72C 'citrix-manag':59B 'citrix-sharefil':22B 'cloud':62B 'compromis':52B,84C 'control':7A,33B,44B,54B,70C,76C,88C 'controller':21A 'cve':9A,12A 'cwe':34B 'exploit':25B 'host':29B,39B 'improp':5A,31B,68C 'instruct':96C 'kev':58B 'let':47B 'list':55B 'manag':61B 'may':77C 'per':94C 'ransomwar':26B 'remot':50B,83C 'requir':90C 'self':28B,38B 'self-host':27B,37B 'sharefil':2A,4A,24B,41B,73C 'sharefile':16A,18A 'storag':42B,63B,74C,86C 'storage':19A 'unauthent':49B,80C 'updat':93C 'vendor':30B,95C 'vulner':8A 'zone':43B,64B,75C,87C 'zones':20A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-09-23T13:15:08+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-22941","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-22941","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T15:39:43+00:00","note":null},{"source":"epss","external_id":"CVE-2021-22941","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-22941","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2021-22941:56","url":null,"severity":null,"published_at":"2026-10-23T21:20:29+00:00","modified_at":"2026-10-23T21:20:29+00:00","first_seen_at":"2026-10-23T21:20:29+00:00","fetched_at":"2026-10-23T21:20:29+00:00","note":"Fixed 5.11.20 per CERT-EU relaying Citrix CTX328123, CVE record, Helient. Citrix page itself unreadable (empty fetch). No public IOCs or PoC found; exploitation per CISA KEV (ransomware use per KEV flag, not verified)."},{"source":"nvd","external_id":"CVE-2021-22941","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22941","severity":null,"published_at":"2021-09-23T13:15:08+00:00","modified_at":"2026-06-17T03:38:04+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":940,"url":"https://cert.europa.eu/publications/security-advisories/2021-050/","title":"CERT-EU 2021-050: Critical vulnerability in Citrix ShareFile (relays CTX328123)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":944,"url":"https://www.cve.org/CVERecord?id=CVE-2021-22941","title":"CVE Record CVE-2021-22941 (references CTX328123)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":942,"url":"https://www.helient.com/news/2021/09/citrix-sharefile-storage-zones-controller-security-update","title":"Helient: ShareFile SZC security update (quotes Citrix: cloud-managed zones not affected)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}