CVE-2021-22893

Ivanti Pulse Connect Secure's use-after-free vulnerability allowed unauthenticated attackers to execute code remotely, and is actively being exploited in ransomware attacks.

A critical use-after-free vulnerability in Ivanti Pulse Connect Secure enables remote code execution without authentication, and is currently being exploited in the wild, often linked to ransomware. DIB organizations using this product face immediate exposure and potential compliance failures under CMMC/NIST 800-171, requiring urgent patching and incident response. Verify your environment’s status and apply Ivanti’s provided patches immediately.

Shame score — The vulnerability's ease of exploitation, remote access, and active ransomware association demonstrate significant negligence and pose a severe risk to DIB organizations.