Threat actorcritical
Multiple APT Groups Exploit Critical Pulse Secure Zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-11510 | Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN | 10.0 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2020-8243 | Authenticated Arbitrary Code Execution via Template Upload in Ivanti Pulse Connect Secure | 7.2 | 91% | KEV | KEV |
| CVE-2020-8260 | Authenticated RCE in Ivanti Pulse Connect Secure admin web interface (pre-9.1R9) | 7.2 | 96% | KEVPoC | KEV |
| CVE-2021-22893 | Use-After-Free RCE in Ivanti Pulse Connect Secure License Services | 10.0 | 48% | KEVRansomware | KEV |
From the original article
2 min read at infosecurity-magazine.com
Pulse Secure customers have been urged to take immediate steps to mitigate a critical zero-day vulnerability in the popular VPN platform, after researchers revealed multiple APT groups are targeting it. CVE-2021-22893 has a CVSS score of 10. 0 and is listed as a critical authentication bypass vulnerability in Pulse Connect Secure.
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.