Critical severity · published Apr 23, 2021
CVE-2021-22893
Ivanti Pulse Connect Secure Use-After-Free Vulnerability
RansomwareIn wildKEV
10.0
CVSS
47.2%
EPSS
Yes
On KEV
Description
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)47.2% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useKnown
Affected products
Which versions
CS
Connect Secure · Ivanti
PCS 9.0R3 or above, PCS 9.1R1 and above · source: vendor, NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22893
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22893
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/
x_refsource_MISC
https://blog.pulsesecure.net/pulse-connect-secure-security-update/
x_refsource_MISC
https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html
x_refsource_MISC
https://kb.cert.org/vuls/id/213092
More from Connect Secure
10.0
CVE-2019-11510
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
9.8
CVE-2025-22457
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
9.1
CVE-2024-21887
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
9.0
CVE-2025-0282
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
8.8
CVE-2021-22899
Ivanti Pulse Connect Secure Command Injection Vulnerability