CVE-2021-44720: Ivanti Connect Secure

High severity, CVSS 7.2. EPSS: 2.7% chance of exploitation in the next 30 days.

In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets > Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role.

Affected products

• Ivanti Connect Secure: version 9.1 only
• Pulse Secure Pulse Connect Secure: before 9.1 (fixed in 9.1)

Published 2022-08-12. Last modified 2026-06-17.