U.S. Government Issues an Alert of Attacks on Unpatched Pulse VPN Servers

The US Cybersecurity and Infrastructure Security Agency (CISA) alerted organizations to patch their Pulse Secure VPN servers as a defense against ongoing attacks trying to exploit a known remote code execution (RCE) vulnerability.

Pulse Secure provided a public patch for the vulnerability on April 24, 2019 and urged its customers to immediately apply it, which is listed by CISA as highly critical. Those customers that have applied the patch are no longer vulnerable to the attacks.

“Affected organizations that have not applied the software patch to fix a remote code execution (RCE) vulnerability,” the CISA alert warns, “can become compromised in an attack.”

Bad Packets reported on January 10 that there were still 3,623 vulnerable Pulse Secure VPN servers, including 1,233 in the United States. A similar scan conducted on January 4 showed 3,825 vulnerable servers — only a slight improvement over the past week.

“CISA expects to see continued attacks exploiting unpatched Pulse Secure VPN environments and strongly urges users and administrators to upgrade to the corresponding fixes,” today’s DHS alert warns.

Reference:

https://www.us-cert.gov/ncas/alerts/aa20-010a

https://twitter.com/bad_packets/status/1215680652323897346