PT-2021-2786 · Pulse Secure · Pulse Connect Secure

Published 2021-04-20 · Updated 2025-05-23 · CVE-2021-22893

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pulse Connect Secure versions 9.0R3/9.1R1 and higher

Description The issue is related to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure. This vulnerability can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. The vulnerability has been exploited in the wild.

Recommendations For Pulse Connect Secure versions 9.0R3/9.1R1 and higher, consider disabling the Windows File Share Browser and Pulse Secure Collaboration features as a temporary workaround until a patch is available. Restrict access to the Pulse Connect Secure gateway to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Improper Authentication

Weakness Enumeration

CWE-416

CWE-287

Related Identifiers

BDU:2021-02329

CVE-2021-22893

Affected Products

Pulse Connect Secure

References · 41

• 🔥 https://github.com/ZephrFish/CVE-2021-22893 · Exploit
• 🔥 https://github.com/ZephrFish/CVE-2021-22893_HoneyPoC2 · Exploit
• 🔥 https://github.com/onsecuredev/CVE-2021-22893 · Exploit
• 🔥 https://github.com/byteofandri/CVE-2021-22893 · Exploit
• 🔥 https://github.com/thomsdev/CVE-2021-22893 · Exploit
• 🔥 https://github.com/rakhanobe/CVE-2021-22893 · Exploit
• 🔥 https://github.com/oxctdev/CVE-2021-22893 · Exploit
• 🔥 https://github.com/byteofjoshua/CVE-2021-22893 · Exploit
• 🔥 https://github.com/orangmuda/CVE-2021-22893 · Exploit
• 🔥 https://github.com/Mad-robot/CVE-2021-22893 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-22893 · Security Note
• https://bdu.fstec.ru/vul/2021-02329 · Security Note
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22893 · Vendor Advisory
• https://blog.pulsesecure.net/pulse-connect-secure-security-update · Vendor Advisory