Security readout for executives and security teams
Plain-English summary
This is a critical flaw in Pulse Connect Secure VPN gateways. An unauthenticated attacker could bypass authentication and remotely run code on the gateway. Because VPN gateways protect internal access, compromise can create broad business risk. The source bundle states it has been exploited in the wild and CISA lists it in KEV.
Executive priority
Treat this as emergency-priority for any exposed Pulse Connect Secure gateway. The vulnerability is critical, remotely exploitable without credentials, affects a security boundary device, and is listed as known exploited by CISA.
Technical view
CVE-2021-22893 is an authentication bypass in Pulse Connect Secure, exposed through Windows File Share Browser and Pulse Secure Collaboration features. Affected versions include PCS 9.0R3 or above and PCS 9.1R1 and above. The CVSS 3.1 score is 10.0 with network, no-auth, no-user-interaction remote code execution impact.
Likely exposure
Exposure is most likely where Pulse Connect Secure gateways are internet-facing or reachable by untrusted networks, especially affected 9.0R3+ or 9.1R1+ deployments. The bundle does not identify every fixed version or configuration-specific exception.
Exploitation context
Active exploitation is supported by the CVE description and CISA KEV status. The referenced FireEye research concerns suspected APT activity involving Pulse Secure zero-day exploitation. Do not treat this as theoretical risk.
Researcher notes
The bundle supports CWE-287 authentication bypass and CVSS 10.0 remote exploitation impact. Patch-level details and precise IoCs are not included in the provided evidence, so validation should be tied to Pulse Secure SA44784, CERT VU#213092, CISA KEV, and FireEye reporting.
Mitigation direction
- Immediately identify all Pulse Connect Secure gateways and owners.
- Check Pulse Secure SA44784 for vendor-approved fixes or mitigations.
- Prioritize remediation for internet-facing or partner-accessible gateways.
- Follow CISA KEV remediation expectations for covered environments.
- If remediation is delayed, restrict access using vendor-supported controls.
Validation and detection
- Confirm whether PCS 9.0R3+ or 9.1R1+ is deployed.
- Verify each gateway against Pulse Secure SA44784 guidance.
- Check whether vulnerable features are enabled or externally reachable.
- Review gateway and identity logs for suspicious unauthenticated access patterns.
- Validate remediation by confirming installed fixed versions or vendor mitigations.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-22893 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
10CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/CVE reference · x_refsource_MISC
- https://blog.pulsesecure.net/pulse-connect-secure-security-update/CVE reference · x_refsource_MISC
- https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.htmlCVE reference · x_refsource_MISC
- https://kb.cert.org/vuls/id/213092CVE reference · x_refsource_MISC
- https://www.kb.cert.org/vuls/id/213092CVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authentication
Improper Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.