Pulse Connect Secure: A View from the Internet

This report analyzes Censys scan data to identify and fingerprint Internet-facing Pulse Connect Secure appliances, maps unique HTTP artifacts to specific build versions, and quantifies how many hosts are vulnerable to seven Pulse security advisories (notably SA44784/CVE-2021-22893, which has been observed in active exploitation). It provides country/AS/version breakdowns, scripts and SQL used to correlate file-hash artifacts to client binaries to determine exact builds, and produces a vulnerability matrix to track affected deployments.