CVE-2021-22893
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connec...
Affects 1 product across 1 vendor.
Software does not prove or insufficiently proves that the user is who they claim to be.
Software references memory after it has been freed, leading to corruption, crashes, or code execution.
Show all 10
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
CVE-2021-22893 affects Pulse Connect Secure versions 9.0R3/9.1R1 and higher, enabling an unauthenticated attacker to bypass authentication and execute arbitrary code remotely. The vulnerability has a CVSS score of 10.0 and has been exploited in the wild. Immediate action is required to mitigate the risk.
BSID: BS-2021-GLOBAL-242639-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2021-22893?
What is the CVSS score for CVE-2021-22893?
Is CVE-2021-22893 actively exploited?
How do I remediate CVE-2021-22893?
What systems are affected by CVE-2021-22893?
What NERC-CIP standard applies to CVE-2021-22893?
What IEC 62443 requirement maps to CVE-2021-22893?
| CVE ID | CVE-2021-22893 |
|---|---|
| BSID | BS-2021-GLOBAL-242639-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Published | 2021-04-23 |
| Last Modified | 2026-08-12 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
Source: NIST NVD / MITRE CVE Database
The vulnerability is exposed through the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure. An unauthenticated attacker can exploit this vulnerability to bypass authentication and execute arbitrary code on the affected system.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Ivanti | Connect Secure | 9.0 9.1 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | ● Active Exploitation Confirmed (added 2021-11-03) |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement network segmentation to isolate the Pulse Connect Secure gateway from critical systems. Monitor network traffic for unusual activity and apply the latest vendor patches immediately.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This CVE violates CIP-007-R2 as it allows unauthorized access to the control center, which could compromise the security of the electronic security perimeter.
This CVE maps to SR 7.6 because it involves a vulnerability that can be exploited to gain unauthorized access to the system, which is a critical security concern for ICS environments.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 75ff9577ca35faab825a9fa19c9a05c2b6a6b965a5a5a2b21334f1795bcacaca2b00a3ff19fdf6d3345c489930a3e4c203323a128e5bdcb0cc8d30590686242e |
This Vulnerability Is Being Actively Exploited
CVE-2021-22893 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →