Loading vulnerability…
Authentication Bypass and Remote Code Execution in Pulse Connect Secure
CVE-2021-22893 is an authentication bypass vulnerability affecting unpatched Pulse Connect Secure releases starting with 9.0R3 and 9.1R1. Exposed through the Windows File Share Browser and Pulse Secure Collaboration features, it allows an unauthenticated remote attacker to execute arbitrary code on the VPN gateway. The vulnerability has been exploited in the wild for initial access to organizational networks.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution on the Pulse Connect Secure gateway and provides a foothold in the connected private network. Observed post-exploitation activity includes modification of appliance software, installation of webshells, credential logging, bypass of authentication flows including MFA, and persistent access. Patching alone may not remove existing backdoors or invalidate stolen credentials.
If you can’t patch tonight, do this now.
If immediate patching is impossible, apply the vendor's interim XML workaround to disable Windows File Share Browser and Pulse Secure Collaboration. These features do not automatically re-enable after the corrective update. Run the Pulse Connect Secure Integrity Tool and review unauthenticated web requests, remote logs, and authentication anomalies. Correlate successful VPN logins with failed LDAP or RADIUS authentication events. Integrity checking is detection rather than prevention and is limited by the currently running appliance version; preserve evidence before upgrades.
Patch, then assume compromise.
Apply the vendor update addressing CVE-2021-22893 under advisory SA44784; Pulse Connect Secure 9.1R11.4 was released on May 3, 2021 with the fix. Check appliance integrity and investigate signs of compromise. For compromised appliances, preserve forensic evidence, disable the external interface, save configurations, factory-reset through the serial console, update software, restore configurations, and rerun the integrity tool before returning to service. Reset potentially exposed user, service, and administrative credentials and investigate the connected network for further compromise.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.