← Back to CVEs

CVE-2021-22893

CRITICALCISA KEV

10.0

Description

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

CVE Details

CVSS v3.1 Score10.0

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published4/23/2021

Last Modified12/18/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorIvanti

ProductPulse Connect Secure

Vulnerability NameIvanti Pulse Connect Secure Use-After-Free Vulnerability

KEV Date Added2021-11-03

Remediation Due Date2022-05-03

Ransomware UseKnown

Affected Products

ivanti:connect_secure

Weaknesses (CWE)

CWE-287CWE-416

References

https://blog.pulsesecure.net/pulse-connect-secure-security-update/(support@hackerone.com)

https://kb.cert.org/vuls/id/213092(support@hackerone.com)

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/(support@hackerone.com)

https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html(support@hackerone.com)

https://blog.pulsesecure.net/pulse-connect-secure-security-update/(af854a3a-2127-422b-91ae-364da2661108)

https://kb.cert.org/vuls/id/213092(af854a3a-2127-422b-91ae-364da2661108)

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/(af854a3a-2127-422b-91ae-364da2661108)

https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.kb.cert.org/vuls/id/213092(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.