CVE-2021-22894: Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 41.3% chance of exploitation in the next 30 days.

A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.

Affected products

• Ivanti Connect Secure: version 9.0 only; version 9.1 only

Published 2021-05-27. Last modified 2026-06-17.