CVE-2021-22893 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2021-22893CRITICAL

n/a Pulse Connect Secure — Ivanti Pulse Connect Secure

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .4717   98.7   YES

AFFECTED
  Product               Versions                                   Fixed
  Pulse Connect Secure  PCS 9.0R3 or above, PCS 9.1R1 and above –  —

TIMELINE
  Jan 6   Reserved by hackerone
  Nov 3   Added to CISA KEV, remediation due 2022-05-03
  Nov 3   Published (CNA: hackerone)

CWE-416, CWE-287 · CNA: hackerone · CVSS v3.1 · 6 references · NVD status: Analyzed · KEV due May 3, 2022

Description

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 6, 2021	Reserved	Reserved by hackerone
November 3, 2021	KEV ADDED	Added to CISA KEV, remediation due 2022-05-03
November 3, 2021	Published	Published (CNA: hackerone)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
n/a	Pulse Connect Secure	—	PCS 9.0R3 or above, PCS 9.1R1 and above	—

Weaknesses

CWE-416 · CWE-287

References (6)

https://blog.pulsesecure.net/pulse-connect-secure-security-update/ [Vendor Advisory]
https://kb.cert.org/vuls/id/213092 [Third Party Advisory, US Government Resource]
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/ [Broken Link, Vendor Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893 [US Government Resource]
https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html [Third Party Advisory]
https://www.kb.cert.org/vuls/id/213092 [US Government Resource]

Authoritative record: CVE-2021-22893 at cve.org

Weaknesses: CWE-416 · CWE-287

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-22893 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.