CVE-2021-22893: critical vulnerability in Pulse Connect Secure
Published · Updated
92Vexday Risk Score
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
ssvc Actcvss 10epss 47%
from disclosure to weapon0 days
Published on NVDApr 23
1st PoCApr 21
CISA KEV+194d
exploitation probability
47%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
4 public exploit(s)
Action required by CISAfederal deadline: 2022-05-03
Apply updates per vendor instructions.
In short
Pulse Connect Secure has a critical flaw that allows attackers to bypass login protections and run malicious code on the system without needing valid credentials. This vulnerability is actively being exploited by hackers.
Technical detail
An authentication bypass in Pulse Connect Secure 9.0R3/9.1R1+ through the Windows File Share Browser and Pulse Secure Collaboration features allows unauthenticated remote attackers to achieve arbitrary code execution on the gateway. The vulnerability requires no prior authentication or user interaction, resulting in complete system compromise.
Summary generated and translated by AI from the official description.
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.