Critical Use‑After‑Free in Ivanti Pulse Connect Secure (CVE‑2021‑22893) Allows Remote Code Execution
What It Is – Ivanti Pulse Connect Secure (PCS) contains a use‑after‑free flaw in its license‑services component. An unauthenticated remote attacker can trigger the bug to execute arbitrary code on the appliance.
Exploitability – The vulnerability is rated 9.8 (Critical) on the CVSS v3.1 scale and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.
Affected Products – Ivanti Pulse Connect Secure (all versions prior to the vendor‑released patch, see Ivanti advisory).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability monitoring and rapid patch deployment as evidence of due‑diligence.
- A successful exploit would break the access‑control boundary that remote‑access solutions provide, undermining audit‑ready configurations.
- Remediation can be captured in a Trust Center audit trail, satisfying multiple framework control objectives (e.g., “maintain secure configuration” across NIST CSF, ISO 27001, etc.).
Recommended Actions
- Apply Ivanti’s security patch for CVE‑2021‑22893 immediately.
- Verify the installed version via authenticated scans or configuration inventories.
- Update your vulnerability‑management program to include PCS in continuous monitoring scopes.
- Document the remediation step in your control‑evidence repository for audit readiness.
Source: CISA KEV – CVE‑2021‑22893