Back
Outfaze Security Team

Outfaze Security Team

Pulse Secure Exploitation: Patch, Check Integrity, Hunt

Pulse Secure Exploitation: Patch, Check Integrity, Hunt

In April 2021, CISA issued an emergency directive and advisory on active exploitation of Pulse Connect Secure vulnerabilities. It urged organizations to run the vendor integrity tool because attackers could alter files and maintain access on the appliance.

This was another case where an internet-facing security product required both urgent vendor remediation and a post-compromise investigation.

The integrity question was separate from version

An appliance could be updated yet still contain malicious modifications or stolen credentials from earlier exploitation. CISA analysis described web shells designed to modify gateway files and, in one case, intercept certificate-based MFA.

Because VPN traffic represents legitimate remote access, responders needed identity and internal network evidence to distinguish normal users from attacker activity after the foothold was established.

Treat remote-access appliances as critical servers

Inventory all instances, export logs, run current integrity checks, and follow vendor guidance for updates or rebuilding. Centralize authentication and network telemetry outside the appliance.

If integrity fails or exploitation is found, rotate affected credentials and certificates, revoke sessions, and hunt internal systems reached from the gateway. Validate high-availability nodes and forgotten test appliances.

  • Integrity tools answer a different question from patch scanners.
  • MFA material and sessions may require reset.
  • Gateway logs need independent retention.
  • Remote-access traffic requires user and device context.

Put the lesson into practice

  1. Locate all Pulse Secure appliances and versions.
  2. Preserve logs and run the vendor integrity tool.
  3. Patch or rebuild according to current guidance.
  4. Rotate exposed identity material and hunt internally.
  5. Verify every node before restoring trust.

Related Outfaze guidance

Authoritative sources