CVE-2021-22893

Estado: AnalizadaCrítica (10)⚠ Explotación activa

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Puntuación base: 10

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 47%
Percentil entre todas las CVEs puntuadas: 99
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

Añadida al catálogo: 3/11/2021
Plazo de remediación: 3/5/2022
Uso conocido en ransomware: Known

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1078 Valid Accountsstealth · persistence · privilege escalation · initial access90 %
Impacto secundarioT1059 Command and Scripting Interpreterexecution85 %

Vulnerabilidad de autenticación (CWE-287) en aplicación expuesta (Pulse Connect Secure) accesible remotamente sin privilegios ni interacción. Permite bypass de autenticación y ejecución remota de código.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Application Developer Guidance Active Directory Configuration Vulnerability Scanning User Training User Account Management

Tecnologías afectadas (1)

Ivanti — Connect Secure

CWE

CWE-287
CWE-416

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2021-22893",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-22893",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2021-04-20T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Pulse Connect Secure",
          "versions": [
            {
              "status": "affected",
              "version": "PCS 9.0R3 or above, PCS 9.1R1 and above"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-04-23T17:15:08.127",
  "references": [
    {
      "url": "https://blog.pulsesecure.net/pulse-connect-secure-security-update/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://kb.cert.org/vuls/id/213092",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://blog.pulsesecure.net/pulse-connect-secure-security-update/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://kb.cert.org/vuls/id/213092",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/",
      "tags": [
        "Broken Link",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/213092",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild."
    },
    {
      "lang": "es",
      "value": "Pulse Connect Secure versiones 9.0R3/9.1R1 y posteriores, es susceptible a una vulnerabilidad de omisión de autenticación expuesta por las funciones de Windows File Share Browser y Pulse Secure Collaboration de Pulse Connect Secure, que pueden permitir a un usuario no autenticado llevar a cabo una ejecución de código remoto arbitrario en Pulse Connect Secure gateway.&#xa0;Esta vulnerabilidad ha sido explotado en el wild"
    }
  ],
  "lastModified": "2026-08-12T05:17:37.347",
  "cisaActionDue": "2022-05-03",
  "cisaExploitAdd": "2021-11-03",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3818B543-3415-4E27-8DAD-6BA9D3D9A1A5"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D47D09A8-4AC4-4CD9-B648-5F26453E2E1D"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59331DC5-FF5F-4BB3-905E-5A4A621F86ED"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A708C3F-9050-4475-95B3-4785D3E2CB69"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52851AAA-88FB-40BC-B41A-B821F6BA9F79"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F05DC11E-7C41-450B-A2BF-603E9252BB40"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DA976D9-A330-475E-B8C0-09EF3E08F18D"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59F4A6F7-A6D4-4517-A316-7C7C002A9ED3"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "702094B0-2E5C-4A16-A8B0-F0EAF78E4ECB"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A369AE09-17E4-4541-A8E1-A2F4A1398EE7"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24EF2F1A-8140-4FDB-8AF4-309AFAF998E1"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4755BC2C-A96E-47AF-9D7C-E8D44B31F10B"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF6E8A0C-192B-4F51-86AA-FC2B85657632"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F450898-0B06-4073-9B76-BF22F68BD14F"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B21C181-DC49-4EBD-9932-DBB337151FF7"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AA4B39F-2FB9-4752-B1F1-18812B0990B4"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "232BAB6C-D318-4F80-8F49-4E700C21F535"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABD840BF-944E-4F4C-96DC-0256286338F6"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1995F34-AE75-47C4-9A9D-DBB1D3E130E5"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "366EF5B8-0233-49B8-806A-E54F60410ADE"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4FEFC4B1-7350-46F9-80C1-42F5AE06142F"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB7A6D62-6576-4713-9BF4-11068A72E8B7"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "843BC1B9-50CC-4F8F-A454-A0CEC6E92290"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5355372-03EA-46D7-9104-A2785C29B664"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3DE32A0C-8944-4F51-A286-266055CA4B2F"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0349A0CC-A372-4E51-899E-D7BA67876F4B"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93D1A098-BD77-4A7B-9070-A764FB435981"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CCC2D7B-F835-45EC-A316-2F0C5F2CF565"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD812596-C77C-4129-982F-C22A25B52126"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9FA0B20D-3FA1-42AE-BDC5-93D8A182927C"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFFA0B02-7F6D-4434-B1E7-EB8520FD68A0"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFE8FA87-9622-4D5B-99C7-D8EE230C0AA9"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07AB853D-5A3F-4142-8417-1C9FB729A89E"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16DAA769-8F0D-4C54-A8D9-9902995605B0"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2C10C89-1DBC-4E91-BD28-D5097B589CA9"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F54753D0-6275-4F82-B874-55438D2983B3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Ivanti Pulse Connect Secure Use-After-Free Vulnerability"
}