Threat actors are actively unleashing attacks that attempt to steal encryption keys, passwords and other sensitive data from vulnerable Pulse Secure VPN servers.

An authentication by-pass vulnerability (CVE-2021-22893) in the components Windows File Share Browser and Pulse Secure Collaboration of Pulse Connect Secure may allow an unauthenticated attacker to execute arbitrary code on the target system.

Pulse Secure recommends disabling the two affected components on existing PCS instances:

• Windows File Share Browser
• Pulse Secure Collaboration

Pulse Secure has published a Workaround-2104.xml (Download Center at https://my.pulsesecure.net) file that contains mitigations to protect against this vulnerability. As outlined in the Pulse Secure advisory, be sure that the Windows File Share Browser feature is disabled after importing the XML workaround.