CVE-2021-22893

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

• CWE-287
• CWE-416

• https://blog.pulsesecure.net/pulse-connect-secure-security-update/Vendor Advisory
• https://kb.cert.org/vuls/id/213092Third Party Advisory, US Government Resource
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/Broken Link, Vendor Advisory
• https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.htmlThird Party Advisory
• https://blog.pulsesecure.net/pulse-connect-secure-security-update/Vendor Advisory
• https://kb.cert.org/vuls/id/213092Third Party Advisory, US Government Resource
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/Broken Link, Vendor Advisory
• https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.htmlThird Party Advisory
• https://www.kb.cert.org/vuls/id/213092US Government Resource
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893US Government Resource

Published

Apr 23, 2021

Last Modified

Aug 12, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22888Revive Adserver before v5.2.0 is vulnerable to a reflected X…6.1
• CVE-2021-22889Revive Adserver before v5.2.0 is vulnerable to a reflected X…6.1
• CVE-2021-2289Vulnerability in the Oracle Product Hub product of Oracle E-…8.1
• CVE-2021-22890curl 7.63.0 to and including 7.75.0 includes vulnerability t…3.7
• CVE-2021-22891A missing authorization vulnerability exists in Citrix Share…9.8
• CVE-2021-22892An information disclosure vulnerability exists in the Rocket…7.5
• CVE-2021-22894A buffer overflow vulnerability exists in Pulse Connect Secu…8.8
• CVE-2021-22895Nextcloud Desktop Client before 3.3.1 is vulnerable to impro…5.9
• CVE-2021-22896Nextcloud Mail before 1.9.5 suffers from improper access con…4.3
• CVE-2021-22897curl 7.61.0 through 7.76.1 suffers from exposure of data ele…5.3
• CVE-2021-22898curl 7.7 through 7.76.1 suffers from an information disclosu…3.1
• CVE-2021-22899A command injection vulnerability exists in Pulse Connect Se…8.8