10.0 Critical Exploited · ransomware

CVE-2021-22893 Ivanti Pulse Connect Secure Use-After-Free Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Known to be used

Weakness CWE-287

Description

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

Affected products and versions

Product	Affected versions	Fixed in
Pulse Connect Secure	Versions not published

References

kb.pulsesecure.net kb.pulsesecure.net
blog.pulsesecure.net blog.pulsesecure.net
www.fireeye.com www.fireeye.com
kb.cert.org kb.cert.org

Timeline

Published April 23, 2021
Added to the KEV catalogue November 3, 2021
Last modified August 12, 2026

The 21 CVEs of Pulse Connect Secure →

CVE-2021-22965 A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a… Not rated CVE-2021-22937 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write… Not rated CVE-2021-22936 A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack… Not rated CVE-2021-22935 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command… Not rated

Track this CVE