CVE-2021-22893
Ivanti Pulse Connect Secure Use-After-Free Vulnerability
Description
CVE-2021-22893 is a maximum-severity vulnerability in Ivanti Pulse Connect Secure (PCS), a widely deployed SSL VPN appliance used by enterprises and government agencies for remote access. The vulnerability combines an authentication bypass with a use-after-free condition, exposed through the Windows File Share Browser and Pulse Secure Collaboration features, allowing an unauthenticated attacker to perform remote arbitrary code execution on the gateway. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and it has been associated with ransomware campaigns. With an EPSS score of 93.61% (99.83rd percentile) and a perfect CVSS score of 10.0, this Ivanti Pulse Connect Secure vulnerability represents the highest possible threat level.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect secure | 9.0; 9.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://blog.pulsesecure.net/pulse-connect-secure-security-update/(Vendor Advisory)
- https://kb.cert.org/vuls/id/213092(Third Party Advisory, US Government Resource)
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/(Broken Link, Vendor Advisory)
- https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html(Third Party Advisory)
- https://www.kb.cert.org/vuls/id/213092(US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
Improper authentication occurs when software does not sufficiently prove that an actor's claimed identity is correct. In CVE-2021-22893, the Pulse Connect Secure gateway contains an authentication bypass in the Windows File Share Browser and Collaboration features, allowing unauthenticated attackers to access functionality that should require valid credentials.
Learn more: CWE-287 — Improper Authentication
CWE-416: Use After Free
Use After Free (UAF) is a memory corruption vulnerability where software continues to use a pointer after the memory it references has been freed. In CVE-2021-22893, the use-after-free condition in Pulse Connect Secure enables attackers to execute arbitrary code by manipulating freed memory during the exploitation of license service functionality.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2021-22893 carries a perfect CVSS 3.1 base score of 10.0 (CRITICAL), the maximum possible severity rating. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, and has a changed scope meaning exploitation can impact resources beyond the vulnerable component itself. All three impact dimensions are rated high: confidentiality, integrity, and availability are fully compromised. Attackers can gain complete control of the Pulse Connect Secure gateway, intercept VPN traffic, steal credentials, pivot into internal networks, and disrupt remote access for the entire organization. The changed scope (S:C) amplifies the danger, as compromising the VPN gateway provides a foothold into the broader enterprise network. Critically, this vulnerability has been associated with ransomware campaigns and was actively exploited by suspected state-sponsored threat actors. The EPSS score of 93.61% (99.83rd percentile) indicates near-certain exploitation activity. CISA issued Emergency Directive 21-03 specifically to address this and related Pulse Connect Secure vulnerabilities, underscoring the exceptional severity.
Exploit Maturity
CVE-2021-22893 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog and is known to be used in ransomware attacks. CISA issued Emergency Directive 21-03 specifically addressing Pulse Connect Secure vulnerabilities, highlighting the critical nature of this threat. The vulnerability was identified as being exploited by suspected state-sponsored actors leveraging zero-day techniques before a patch was available. The EPSS score of 93.61% (99.83rd percentile) indicates near-certain exploitation activity. Technical analysis of the exploitation was published by FireEye/Mandiant, which documented multiple threat actors exploiting this vulnerability to deploy webshells and backdoors on Pulse Connect Secure appliances. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV and Emergency Directive 21-03: Apply updates per vendor instructions. Install the security update provided by Ivanti (formerly Pulse Secure) that addresses this authentication bypass and use-after-free vulnerability.
- Verify that all Pulse Connect Secure appliances running versions 9.0R3/9.1R1 and higher have been updated to the patched release. Run the Pulse Secure Integrity Checker Tool to detect any indicators of compromise on the appliance.
- If immediate patching is not possible, disable the Windows File Share Browser and Pulse Secure Collaboration features on affected appliances as an interim mitigation, as these are the attack vectors for this vulnerability. Implement IP-based access restrictions to limit VPN gateway access to known, trusted networks.
- Conduct thorough forensic analysis of Pulse Connect Secure appliances, reviewing logs for signs of unauthorized access, webshell deployments, credential theft, or lateral movement into the internal network. Reset all credentials that may have been exposed through the compromised VPN gateway.
- As a long-term hardening measure, implement network segmentation between VPN gateway and internal resources, deploy multi-factor authentication for all VPN access, enable comprehensive logging and monitoring of VPN appliance activity, and establish a vulnerability management process ensuring rapid patching of internet-facing infrastructure.
Technical Details
CVE-2021-22893 affects Pulse Connect Secure versions 9.0R3/9.1R1 and higher, combining two distinct weakness types. The authentication bypass (CWE-287) in the Windows File Share Browser and Pulse Secure Collaboration features allows unauthenticated users to access protected functionality. The use-after-free condition (CWE-416) in the license service enables code execution through memory corruption. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects the maximum possible score of 10.0, with network-based exploitation requiring no privileges, user interaction, or special conditions, combined with changed scope indicating cross-component impact. The NVD description explicitly states that this vulnerability has been exploited in the wild. Suspected APT actors leveraged this as a zero-day vulnerability to deploy multiple webshell families on compromised Pulse Connect Secure appliances, using them as persistent backdoors for espionage operations and data exfiltration.
Frequently Asked Questions
Is CVE-2021-22893 being actively exploited?
Yes. CVE-2021-22893 is listed in the CISA Known Exploited Vulnerabilities catalog and was the subject of CISA Emergency Directive 21-03. It has been associated with ransomware campaigns and was exploited by suspected state-sponsored threat actors as a zero-day. The EPSS score of 93.61% (99.83rd percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2021-22893?
CVE-2021-22893 affects Ivanti Pulse Connect Secure (formerly Pulse Secure) versions 9.0R3/9.1R1 and higher. The vulnerability is in the Windows File Share Browser and Pulse Secure Collaboration features of the VPN gateway appliance.
How do I fix CVE-2021-22893?
Apply the security update from Ivanti immediately. Run the Pulse Secure Integrity Checker Tool to detect compromise indicators. If patching is not immediately possible, disable the Windows File Share Browser and Pulse Secure Collaboration features as an interim mitigation. Reset all credentials that may have been exposed.
How severe is CVE-2021-22893?
CVE-2021-22893 has a perfect CVSS 3.1 base score of 10.0 (CRITICAL) and an EPSS score of 93.61% at the 99.83rd percentile. It is the maximum possible severity, enabling unauthenticated remote code execution on VPN gateway appliances, and is associated with both ransomware and state-sponsored attacks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.