Pulse Secure
Remote-access VPN vendor acquired by Ivanti in December 2020.
A Pulse Connect Secure flaw sat on the exploited list of joint advisory AA26-281A on 8 October 2026, six years after the VPN line passed to Ivanti and long after Pulse Secure's bugs first drew emergency federal orders.
Last refreshed: 12 October 2026
Why did patching Pulse Secure VPNs not lock attackers out?
Timeline for Pulse Secure
Named as Pulse Secure
Cybersecurity: Threats and Defences: Mentioned in: Ten agencies name Beijing firm in hacksNamed as Pulse Secure
Cybersecurity: Threats and Defences: Mentioned in: Citrix replaces its own NetScaler fixMentioned in: Triple CVSS-10 Ubiquiti chain hits root
Cybersecurity: Threats and DefencesMentioned in: CISA gives Cisco SD-WAN three days to patch
Cybersecurity: Threats and DefencesBackground
Pulse Secure built Pulse Connect Secure, an appliance that lets staff reach a corporate network from outside. Affiliates of Siris Capital Group sold the company to Ivanti, itself backed by Clearlake Capital and TA Associates, in a deal completed in December 2020, and the VPN product line moved to its new owner.
Few EDGE devices taught defenders more than Pulse Connect Secure. In alert AA20-107A, first issued on 16 April 2020, CISA described intruders logging in with Active Directory passwords taken through CVE-2019-11510 months after victims had installed the patch, since nobody had reset those credentials. On 20 April 2021 CISA Emergency Directive 21-03 gave US federal agencies three days to inventory every Pulse Connect Secure appliance over CVE-2021-22893 and run Pulse's Integrity Tool on each by 23 April.
Pulse Secure's old flaws still circulate in 2026. AA26-281A, signed by ten agencies on 8 October, named a Pulse Connect Secure weakness among those its hackers used; CISA's Known Exploited Vulnerabilities catalogue already carried it.