Skip to content
OpenAdvisories
Critical · 10.0 Known exploited · Ransomware Public exploit CVE-2021-22893 EUVD-2021-10025GHSA-hcxw-prp6-q3jq

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Brows…

Published Apr 23, 2021 · Updated Aug 12, 2026 · Assigned by hackerone

Description

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

Affected products

VendorProductAffectedFixed
— Pulse Connect Secure PCS 9.0R3 or above, PCS 9.1R1 and above —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References