CVE-2021-22893
CRITICAL KEV RANSOMWAREPulse Connect Secure >=9.0R3/9.1R1 - Auth Bypass
Title source: llmDescription
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
Exploits (12)
github
34 stars
by DarkFunct · cpoc
https://github.com/DarkFunct/CVE_Exploits/tree/main/CVE-2021-22893
References (6)
Scores
CVSS v3
10.0
EPSS
0.9361
EPSS Percentile
99.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Details
CISA KEV
2021-11-03
VulnCheck KEV
2021-04-20
InTheWild.io
2021-04-28
ENISA EUVD
EUVD-2021-10025
Ransomware Use
Confirmed
CWE
CWE-287
CWE-416
Status
published
Products (2)
ivanti/connect_secure
9.0 (13 CPE variants)
ivanti/connect_secure
9.1 (23 CPE variants)
Published
Apr 23, 2021
KEV Added
Nov 03, 2021
Tracked Since
Feb 18, 2026