Ivanti Pulse Connect Secure known exploited vulnerabilities, ranked
CISA lists 7 Ivanti Pulse Connect Secure CVEs as exploited in the wild. 0 were added in the last 12 months and 2 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2019-11510: EPSS 100.00%, used in ransomware, added 2021-11-03
- CVE-2020-8260: EPSS 96.5%, added 2021-11-03
- CVE-2020-8243: EPSS 90.8%, added 2021-11-03
- CVE-2021-22893: EPSS 47.2%, used in ransomware, added 2021-11-03
- CVE-2021-22894: EPSS 41.3%, added 2021-11-03
All 7 Ivanti Pulse Connect Secure CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2019-11510 | Pulse Connect Secure Arbitrary File Read | 100.00% | Yes | 2021-11-03 | 2022-05-03 |
| 2 | CVE-2020-8260 | Pulse Connect Secure Code Execution | 96.5% | – | 2021-11-03 | 2022-05-03 |
| 3 | CVE-2020-8243 | Pulse Connect Secure Code Execution | 90.8% | – | 2021-11-03 | 2022-05-03 |
| 4 | CVE-2021-22893 | Pulse Connect Secure Use-After-Free | 47.2% | Yes | 2021-11-03 | 2022-05-03 |
| 5 | CVE-2021-22894 | Pulse Connect Secure Collaboration Suite Buffer Overflow | 41.3% | – | 2021-11-03 | 2022-05-03 |
| 6 | CVE-2021-22899 | Pulse Connect Secure Command Injection | 22.9% | – | 2021-11-03 | 2022-05-03 |
| 7 | CVE-2021-22900 | Pulse Connect Secure Unrestricted File Upload | 14.1% | – | 2021-11-03 | 2022-05-03 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Ivanti KEV CVEs · other Ivanti products: Endpoint Manager Mobile (EPMM) · free KEV badge for Ivanti · all vendors