CVE-2021-22893: Ivanti (Pulse) Connect Secure authentication bypass, exploited by nation-state actors
The short version: Pulse Connect Secure — the SSL VPN now owned by Ivanti — has a flaw (CVE-2021-22893) that lets an unauthenticated attacker execute code on the gateway and bypass authentication, including MFA. It scores a perfect 10.0, it was exploited as a zero-day by suspected nation-state groups who dropped webshells for persistence, and it's in CISA's KEV catalog. Patching is necessary but not sufficient — you also have to hunt. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | ~47% · 98.70th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-05-03 |
| Known exploited? | Yes — exploited as a zero-day by suspected nation-state actors (UNC2630/UNC2717) |
| Vulnerability type | CWE-416 use-after-free → authentication bypass → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Pulse Connect Secure 9.0R3 / 9.1R1 and higher, prior to 9.1R11.4 (File Share Browser / Pulse Collaboration features) |
| Fixed in | Pulse Connect Secure 9.1R11.4 |
What you need to know
CVE-2021-22893 lives in the Windows File Share Browser and Pulse Collaboration features of Pulse Connect Secure. An unauthenticated attacker can exploit it to run arbitrary code on the gateway and step past authentication entirely — the appliance treats them as a legitimate, authenticated user.
- It's the remote-access gateway. Compromise here isn't one host — it's the front door to the internal network the VPN protects.
- It's pre-authentication. VPN gateways are meant to be internet-facing so remote staff can connect, so there's no barrier to reaching it.
- It was live before the fix. CISA (AA21-110a) and vendor reporting documented suspected nation-state actors exploiting it as a zero-day, planting webshells and bypassing MFA — so an affected appliance may already have been touched.
How serious we see it
High — the 10.0 matches the real world.
Unauthenticated code execution and authentication bypass on an internet-facing VPN gateway, exploited in the wild by capable actors for initial access, is as serious as external exposure gets. The bounded, reassuring part: it affects a specific product and version range, the fix (9.1R11.4) is published, and exposure is quick to determine. The catch is the usual one for a pre-patch zero-day — a patched appliance and a clean appliance are separate questions, and this one saw hands-on-keyboard intrusions.
Recommendations
Straight from Ivanti/Pulse Secure's advisory (SA44784) and CISA:
- Patch now. Upgrade to Pulse Connect Secure 9.1R11.4 or later.
- Run the Integrity Checker and hunt. Use Ivanti's Integrity Checker Tool and hunt for webshells and anomalous authentication, given the confirmed zero-day window.
- If you find indicators, respond fully. Rebuild the appliance and rotate all credentials, keys, and certificates — this was routinely step one of an intrusion.
- Harden exposure. Limit who can reach the gateway, and disable unused features like File Share Browser and Pulse Collaboration where you can.
- Confirm your exposure first. Verify whether you run an affected Pulse/Ivanti Connect Secure build.
How BreachRisk sees it
BreachRisk answers the first question — do we have an exposed, affected gateway? — from the outside in. Starting from little more than your domain, it discovers internet-facing Ivanti/Pulse Connect Secure portals, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one, surfaced at the top of your results because it's in KEV. This is a version-based detection, so we identify and flag the exposed, affected appliance rather than exploiting it.
That outside-in, continuous view is the point: when a VPN zero-day breaks, the exposed appliance is already mapped, so you go straight to patch-and-hunt.