Pulse Secure vulnerabilities (CVEs)

62 CVEs matched to Pulse Secure by name in NVD, 3 on CISA's Known Exploited list.

Back to the Pulse Secure profile · Alternatives to Pulse Secure · CVE RSS feed

Exploitation riskConfirmed exploited

62 of 62 CVEs assessed

confirmed exploited

used in ransomware

past CISA deadline

EPSS ≥ 10%

>99%

highest single CVE

21 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

CVE-2021-22893 ↗⚠ exploitedransomwareoverdueEPSS 47%LEV ≥>99%Confirmed exploited
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure C…
CVE-2019-11510 ↗⚠ exploitedransomwareoverdueEPSS >99%LEV ≥>99%Confirmed exploited

Recent changes

last 90 days

CVE-2018-20808 is now estimated at a 76% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2021-31922 is now estimated at a 47% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2018-15865 is now estimated at a 27% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2013-5650 is now estimated at a 95% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2013-5649 is now estimated at a 77% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗

CVE severity over time

CVEs by year and severity

Count of matched CVEs by the year NVD published them.
Year	Critical	High	Medium	Low	Total
2021	1	1	0	1	3
2020	2	9	0	2	13
2019	4	9	6	0	19
2018	2	2	11	0	15
2017	0	1	0	0	1
2016	0	1	0	0	1
2014	0	1	4	1	6
2013	0	0	3	1	4

On CISA's Known Exploited Vulnerabilities list

3 of 62 matched CVEs are listed. 3 are past the remediation due date CISA set. 3 are flagged by CISA as known to be used in ransomware campaigns.

Most recent additions

CVE-2019-11510 added 2021-11-03
CVE-2019-11539 added 2021-11-03
CVE-2021-22893 added 2021-11-03

Highest EPSS scores

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

CVE	EPSS	Percentile
CVE-2019-11510	>99%	>99%
CVE-2019-11539	99%	>99%
CVE-2019-11542	66%	99%
CVE-2021-22893	47%	99%
CVE-2019-11508	15%	97%
CVE-2020-11581	9.8%	96%
CVE-2019-11540	7.7%	95%
CVE-2019-11509	7.7%	95%
CVE-2019-11538	7.3%	94%
CVE-2018-6320	4.1%	91%

Known CVEs (62)

RSS ⇢

CVE-2021-31922 ↗HIGH 7.52021
An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved …
CVE-2021-22893 ↗⚠ actively exploitedEPSS 47%CRITICAL 10.02021
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect S…

How this is counted

CVEs come from the US National Vulnerability Database (NVD) and are matched to Pulse Secure by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-08-14.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-21.
Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.