Pulse Connect Secure VPN exploitation and credential harvesting
On April 20, 2021 CISA reported active exploitation of Pulse Connect Secure remote access appliances, including the newly disclosed CVE-2021-22893, with activity dating to June 2020 or earlier. Attackers modified legitimate Pulse files such as Login.cgi to place webshells that harvested credentials of authenticated users and enabled authentication bypass, giving persistent access to agency and private sector networks.
- Victim
- Multiple: U.S. government agencies, critical infrastructure and private sector
- Industry
- Cross-industry
- Country
- Global
- Intrusion began
- Jun 2020
- First disclosed
- Apr 20, 2021
- Actor
- Unattributed
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Authentication
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Remote access gateways are identity infrastructure: patch them on emergency timelines, and assume every credential that passed through a compromised appliance must be reset.
Regulatory and legal outcome
April 20, 2021: CISA Emergency Directive 21-03 ordered federal agencies to assess and mitigate Pulse Connect Secure appliances.
Sources
- Exploitation of Pulse Connect Secure Vulnerabilities (AA21-110A), CISA, Apr 20, 2021
- ED 21-03: Mitigate Pulse Connect Secure Product Vulnerabilities, CISA, Apr 20, 2021
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials 2026 · Identity infrastructure vulnerability
- N-able N-central authentication bypass used to reach managed customer networks 2026 · Identity infrastructure vulnerability
- GlobalProtect authentication bypass used as a ransomware front door 2026 · Identity infrastructure vulnerability
- SimpleHelp RMM OIDC token forgery exploited for technician access 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). Pulse Connect Secure VPN exploitation and credential harvesting. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2021-pulse-connect-secure-exploitation/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.