CVE-2022-21826

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 46.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-30 · updated 2026-06-17
Weakness: CWE-444

Description

Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.

Affected products

Ivanti Connect Secure (Pulse Secure): 9.1, 9.1-r1, 9.1-r1.0, 9.1-r10.0, 9.1-r10.2, 9.1-r11.0 (+32)
Ivanti Connect Secure (Pulse Secure): before 9.1 — fixed in 9.1

How to fix

Upgrade to a fixed version: Ivanti Connect Secure (Pulse Secure) 9.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-21826 or the next vulnerability affects your stack