{"id":"CVE-2021-22893","published":"2021-04-23T17:15:08Z","modified":"2026-08-12T05:17:37Z","title":"Ivanti Pulse Connect Secure Use-After-Free Vulnerability","vendor":"Ivanti","product":"Pulse Connect Secure","tier":"core","eol":null,"description":{"text":"Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an authentication bypass in the Windows File Share Browser and Pulse Secure Collaboration features of Ivanti Pulse Connect Secure, affecting version 9.0R3/9.1R1 and higher. Remote, unauthenticated attackers can exploit it over the network without credentials or user interaction to achieve arbitrary code execution on the Pulse Connect Secure gateway.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:58:23Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.47172,"percentile":0.98832,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2021-22893","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-04-20","exploitedFirstSeen":"2021-04-20","ransomware":true,"evidence":[{"url":"https://us-cert.cisa.gov/ncas/alerts/aa21-110a","date":"2021-04-20"},{"url":"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html","date":"2021-04-20"},{"url":"https://www.mandiant.com/resources/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day","date":"2021-04-20"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22893","date":"2021-04-23"},{"url":"https://cisa.gov/news-events/analysis-reports/ar21-112a","date":"2021-04-29"},{"url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices","date":"2021-05-27"},{"url":"https://cyware.com/news/chinese-cyberspies-unc2630-targeting-us-and-eu-organizations-d94ac724/?web_view=true","date":"2021-06-03"},{"url":"https://securelist.com/apt-trends-report-q2-2021/103517/","date":"2021-07-29"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-209a","date":"2021-08-20"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa21-110a","date":"2021-08-24"}],"evidenceTotal":23,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-416","name":"Use After Free"},{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://blog.pulsesecure.net/pulse-connect-secure-security-update/","tags":["Vendor Advisory"]},{"url":"https://kb.cert.org/vuls/id/213092","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/","tags":["Broken Link","Vendor Advisory"]},{"url":"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html","tags":["Third Party Advisory"]},{"url":"https://blog.pulsesecure.net/pulse-connect-secure-security-update/","tags":["Vendor Advisory"]},{"url":"https://kb.cert.org/vuls/id/213092","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/","tags":["Broken Link","Vendor Advisory"]},{"url":"https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html","tags":["Third Party Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/213092","tags":["US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Use After Free","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability is exploited through an authentication bypass weakness in the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure. Remote attackers leverage this vulnerability to perform remote arbitrary code execution on the Pulse Connect Secure gateway by bypassing authentication controls. The threat actor group UNC2630 has utilized this flaw to harvest login credentials, allowing them to move laterally within affected environments.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Use After Free","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability is exploited through an authentication bypass weakness in the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure. Remote attackers leverage this vulnerability to perform remote arbitrary code execution on the Pulse Connect Secure gateway by bypassing authentication controls. The threat actor group UNC2630 has utilized this flaw to harvest login credentials, allowing them to move laterally within affected environments.","confidence":"high"},{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Use After Free","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability is exploited through an authentication bypass weakness in the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure. Remote attackers leverage this vulnerability to perform remote arbitrary code execution on the Pulse Connect Secure gateway by bypassing authentication controls. The threat actor group UNC2630 has utilized this flaw to harvest login credentials, allowing them to move laterally within affected environments.","confidence":"high"}],"reports":[{"id":"SRC-f144807c3c05fbc98a1a","title":"Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","date":"2022-05-09","mentions":[{"quote":"Pulse Secure VPN systems affected by CVE-2019-11510, CVE-2020-8260, CVE-2020-8243, CVE-2021-22893, CVE-2021-22894, CVE-2021-22899, and CVE-2021-22900","start":62242,"end":62391}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-10025","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-10025","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2021-04-21","earliestUrl":"https://github.com/ZephrFish/CVE-2021-22893_HoneyPoC2","repos":[{"name":"ZephrFish/CVE-2021-22893_HoneyPoC2","url":"https://github.com/ZephrFish/CVE-2021-22893_HoneyPoC2","stars":47,"created":"2021-04-21"},{"name":"orangmuda/CVE-2021-22893","url":"https://github.com/orangmuda/CVE-2021-22893","stars":7,"created":"2021-10-03"},{"name":"MRLEE123456/CVE-2021-22893","url":"https://github.com/MRLEE123456/CVE-2021-22893","stars":0,"created":"2021-04-21"}]},"first":{"date":"2021-04-21","source":"PoC-in-GitHub","url":"https://github.com/ZephrFish/CVE-2021-22893_HoneyPoC2"},"provenance":"source"},"detections":{"cveRules":[{"title":"Pulse Connect Secure RCE Attack CVE-2021-22893","id":"5525edac-f599-4bfd-b926-3fa69860e766","level":"high","status":"stable","path":"rules-emerging-threats/2021/Exploits/CVE-2021-22893/web_cve_2021_22893_pulse_secure_rce_exploit.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-22893/web_cve_2021_22893_pulse_secure_rce_exploit.yml","techniques":["T1190"]}]},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1003"],"provenance":"source"}],"timeline":[{"date":"2021-04-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-110a","provenance":"source"},{"date":"2021-04-21","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/ZephrFish/CVE-2021-22893_HoneyPoC2","provenance":"source"},{"date":"2021-04-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22893","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-10025","provenance":"source"},{"date":"2022-05-09","kind":"report","label":"Named in microsoft.com: Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":194},"priority":{"score":83.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2018 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.77,"detail":"percentile 0.9883"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}