CVE-2021-22893
Summary
| CVE | CVE-2021-22893 |
|---|---|
| State | PUBLISHED |
| Assigner | hackerone |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-04-23 17:15:08 UTC |
| Updated | 2026-08-12 05:17:37 UTC |
| Description | Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild. |
Risk And Classification
Primary CVSS: v3.1 10 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS: 0.471720000 probability, percentile 0.987840000 (date 2026-08-23)
CISA KEV: Listed on 2021-11-03; due 2022-05-03; ransomware use Known
Problem Types: CWE-287 | CWE-416 | CWE-287 Improper Authentication - Generic (CWE-287)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 10 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | ADP | DECLARED | 10 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 10 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
ChangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
CISA Known Exploited Vulnerability
| Vendor | Ivanti |
|---|---|
| Product | Pulse Connect Secure |
| Name | Ivanti Pulse Connect Secure Use-After-Free Vulnerability |
| Required Action | Apply updates per vendor instructions. |
| Notes | Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2021-22893 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ivanti | Connect Secure | 9.0 | - | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r1 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r2 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r2.1 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3.1 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3.2 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3.3 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3.5 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r4 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r4.1 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r5.0 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r6.0 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | - | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r10.0 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r10.2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11.0 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11.3 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r3 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4.2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4.3 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r5 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r6 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r7 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r8 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r8.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r8.2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r8.4 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r9 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r9.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r9.2 | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Na | Pulse Connect Secure | affected PCS 9.0R3 or above, PCS 9.1R1 and above | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.cisa.gov/known-exploited-vulnerabilities-catalog | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.cisa.gov | US Government Resource |
| www.kb.cert.org/vuls/id/213092 | af854a3a-2127-422b-91ae-364da2661108 | www.kb.cert.org | US Government Resource |
| Public KB - SA44784 - 2021-04: Out-of-Cycle Advisory: Pulse Connect Secure RCE Vulnerability (CVE-2021-22893) | af854a3a-2127-422b-91ae-364da2661108 | kb.pulsesecure.net | Broken Link, Vendor Advisory |
| Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day | FireEye Inc | af854a3a-2127-422b-91ae-364da2661108 | www.fireeye.com | Third Party Advisory |
| Pulse Connect Secure Security Update - Pulse Secure Blog | af854a3a-2127-422b-91ae-364da2661108 | blog.pulsesecure.net | Vendor Advisory |
| VU#213092 - Pulse Connect Secure vulnerable to authentication bypass that could allow for remote code execution | af854a3a-2127-422b-91ae-364da2661108 | kb.cert.org | Third Party Advisory, US Government Resource |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2021-11-03T00:00:00.000Z | CVE-2021-22893 added to CISA KEV |
Legacy QID Mappings
- 38838 Pulse Connect Secure Remote Code Execution Vulnerability (SA44784)