Remote Code Execution Patch Bypass in Pulse Connect Secure (CVE-2021-22937)

On August 2, Pulse Secure published an advisory and patches for CVE-2021-22937, a post-authentication remote code execution (RCE) vulnerability in Pulse Connect Secure virtual private network appliances. Richard Warren with NCC Group has published a technical advisory for this flaw, explaining it is a patch bypass for CVE-2020-8260 which he disclosed in October 2020.

For more information, please visit our blog.