Skip to content
Fencer Vulns
medium 5.4

CVE-2022-21826 json

Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request…

published 2022-09-30 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-26985

cvss
5.4
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
46.0%
EPSS 46.0% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.

Patch / fix

  • pulsesecure pulse_connect_secure 9.1

Exploit prediction

46.02% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

  • n/a Pulse Connect Secure VPN Server

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.