Authenticated RCE in Pulse Connect Secure admin web interface via uncontrolled gzip extraction

Successful exploitation allows arbitrary code execution on the affected Pulse Connect Secure appliance. In operational reporting, this class of access enabled attackers to establish persistence on VPN appliances, deploy webshell functionality, harvest credentials, bypass authentication controls including MFA in follow-on activity, and use the device as a foothold for broader intrusion activity.

If immediate patching is not possible, restrict and tightly control access to the administrative web interface, limit administrator authentication exposure, monitor for signs of compromise, and use Ivanti/Pulse integrity-checking guidance and tools where available. Because this vulnerability has been reported as exploited in the wild as part of broader campaigns, organizations should also review appliance logs, hunt for webshells or unauthorized file changes, and reset credentials associated with the Pulse Secure environment if compromise is suspected.

Upgrade Pulse Connect Secure to a fixed release. The provided content states the issue affects versions earlier than 9.1R9 and references Pulse Secure Security Advisory SA44601 for vendor remediation guidance. Apply the vendor patch/update identified in that advisory and ensure the appliance is running a non-vulnerable version.