Security News > 2021 > April > Pulse Secure Critical Zero-Day Security Bug Under Active Exploit

A critical zero-day security vulnerability in Pulse Secure VPN devices has been exploited by nation-state actors to launch cyberattacks against U.S. defense, finance and government targets, as well as victims in Europe, researchers said.

Pulse Secure said that the zero-day will be patched in early May; but in the meantime, the company worked with Ivanti to release both mitigations and the Pulse Connect Secure Integrity Tool, to help determine if systems have been impacted.

"The investigation shows ongoing attempts to exploit four issues: The substantial bulk of these issues involve three vulnerabilities that were patched in 2019 and 2020: Security Advisory SA44101, Security Advisory SA44588 and Security Advisory SA44601," according to a Pulse Secure statement provided to Threatpost.

CVE-2021-22893: A Zero-Day in Pulse Connect Secure VPNs. The newly discovered critical security hole is rated 10 out of 10 on the CVSS vulnerability-rating scale.

"The Pulse Connect Secure team is in contact with a limited number of customers who have experienced evidence of exploit behavior on their PCS appliances," according to Pulse Secure.

Earlier in April, the Department of Homeland Security urged companies that use Pulse Secure VPNs to change their passwords for Active Directory accounts, because in many cases, attackers have already exploited CVE-2019-11510 to hoover up victims' credentials - and now are using those credentials to move laterally through organizations, DHS warned.

News URL

https://threatpost.com/pulse-secure-critical-zero-day-active-exploit/165523/