CVE-2021-22893: Ivanti Pulse Connect Secure authentication bypass and use-after-free enabling RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 10.0, unauthenticated remote code execution, active exploitation in the wild, and known ransomware use make this an urgent risk.

What it is

Pulse Connect Secure 9.0R3/9.1R1 and higher contains an authentication bypass exposed through the Windows File Share Browser and Pulse Secure Collaboration features, combined with a use-after-free condition. An unauthenticated remote attacker can exploit this to execute arbitrary code on the gateway, which is a critical edge device controlling remote access.

Impact

An attacker gains unauthenticated remote code execution on the Pulse Connect Secure gateway, allowing full compromise of the appliance and potentially the internal network it protects. This can lead to credential theft, lateral movement, and persistent access.

Attack surface

The vulnerability is reachable over the network via the Windows File Share Browser and Pulse Secure Collaboration features, requiring no authentication and no user interaction. The CVSS vector confirms AV:N/AC:L/PR:N/UI:N.

Exploitation

The vulnerability has been exploited in the wild, is listed in CISA KEV with known ransomware campaign use, and has a high EPSS probability (0.47172, 98.774th percentile).

What to do

• Apply the vendor security update for Pulse Connect Secure as instructed in the vendor advisory (SA44784) immediately.
• If patching is not immediately possible, disable the Windows File Share Browser and Pulse Secure Collaboration features or apply the vendor-provided mitigation.
• Isolate or restrict network access to the Pulse Connect Secure gateway to trusted sources only.
• Monitor for and investigate any signs of compromise, and reset credentials and certificates if compromise is suspected.
• Review CISA KEV guidance and ensure the due date (2022-05-03) is met.

Detection

• Monitor Pulse Connect Secure logs for unusual authentication bypass attempts or access to the Windows File Share Browser and Collaboration features.
• Hunt for unexpected processes, files, or network connections on the Pulse Connect Secure appliance.
• Use the FireEye threat research indicators to detect known exploitation activity.
• Check for unauthorized configuration changes or new administrative accounts on the gateway.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.