Authentication Bypass RCE in Pulse Connect Secure

Successful exploitation can result in full compromise of the Pulse Connect Secure gateway by an unauthenticated remote attacker. Observed post-exploitation activity included arbitrary code execution, deployment of web shells and other malware, credential harvesting, authentication and MFA bypass, persistence that could survive software updates and in some cases factory-reset-style remediation of the appliance, and use of the compromised VPN appliance as a foothold for broader intrusion activity against internal enterprise networks.

If immediate patching is not possible, disable the Windows File Share Browser and Pulse Secure Collaboration features, including use of the vendor-provided XML workaround referenced for this issue. Verify that those features remain disabled after applying the workaround and note that disabled features may not automatically re-enable after patching. Enable and review unauthenticated request logging, use the vendor integrity tool to detect tampering, inspect the appliance for unauthorized file modifications and web-shell activity, review web and authentication logs for anomalous access patterns, and enforce credential resets and MFA hardening as part of containment.

Upgrade affected Pulse Connect Secure appliances to a fixed release provided by the vendor. The content identifies version 9.1R11.4 as the corrective update released on 2021-05-03, and later vendor updates also addressed related vulnerabilities. Organizations should also apply fixes for associated exploited Pulse Connect Secure vulnerabilities where applicable. If compromise is suspected or confirmed, remediation should include running the vendor integrity-checking tool, removing malicious modifications and web shells, resetting credentials associated with the Pulse Secure environment, and conducting broader incident response and threat hunting because appliance cleanup alone may not evict an attacker who already harvested credentials or moved laterally.