Pulse Secure zero-day: VPNs under attack again
A new Pulse Connect Secure bug is being exploited before a patch exists. Apply the workaround and check the integrity tool.
Two days ago Pulse Secure confirmed a new zero-day in Pulse Connect Secure VPN (CVE-2021-22893), already used together with older bugs against government and defence organisations. A patch is promised for early May.
Until then:
- Apply the workaround Pulse published, which disables the affected features.
- Run the Pulse Secure Integrity Checker Tool to look for modified files on the appliance.
- If it finds anything, treat the VPN as compromised: reset it, and reset every password and session that passed through it.
- Make sure older Pulse bugs are patched. Attackers are combining them.
This is the third year in a row of serious VPN appliance bugs. Treat your VPN as the most exposed system you have: fastest patching, central logs and MFA for every user.