The Cybersecurity and Infrastructure Security Agency (CISA) issued a new warning that attackers continue to target unpatched Pulse Secure VPN systems.
Juniper Networks patched a remote code execution vulnerability CVE-2019-11510 in April 2019. However, hackers are notorious for exploiting older, unpatched systems. Not to mention, internet facing devices.
In August of this year, cybersecurity experts warned hackers were targeting vulnerable Virtual Private Network (VPN) products from Pulse Secure and Fortinet. As a result, those cyber attacks posed a major risks to enterprise networks.
In September, UK cyber threat intelligence experts published an advisory describing how Advanced Persistent Threat (APT) actors continued to exploit these same VPN vulnerabilities.
“Unpatched Pulse Secure VPN servers continue to be an attractive target for malicious actors,” CISA stated in the latest security alert.
“CISA expects to see continued attacks exploiting unpatched Pulse Secure VPN environments and strongly urges users and administrators to upgrade to the corresponding fixes.”
For more patch details, network administrators can also review the full Pulse Secure security advisory SA44101 – 2019-04: Out-of-Cycle Advisory: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure 9.0RX.