8.8 High Exploited

CVE-2021-22894 Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-94

Description

A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.

Affected products and versions

Product	Affected versions	Fixed in
Pulse Connect Secure	Versions not published

References

kb.pulsesecure.net kb.pulsesecure.net

Timeline

Published May 27, 2021
Added to the KEV catalogue November 3, 2021
Last modified October 21, 2025

The 21 CVEs of Pulse Connect Secure →

CVE-2021-22965 A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a… Not rated CVE-2021-22937 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write… Not rated CVE-2021-22936 A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack… Not rated CVE-2021-22935 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command… Not rated

Track this CVE