Ivanti Pulse Secure Found Using 11-Year-Old Linux Version and Outdated Libraries

Eclypsium's analysis of Ivanti Pulse Secure firmware (version 9.1.18.2-24467.1) reveals the product runs an outdated CentOS 6.4-based stack with thousands of cumulative vulnerabilities (including many with public exploits), numerous vulnerable libraries, outdated packages and certificates, and logic flaws in Ivanti's Integrity Checker Tool that exclude key directories from scanning. The report ties these findings to active exploitation and scanning of multiple Ivanti CVEs, demonstrates obtaining remote access via published PoCs and exporting device images for analysis, and highlights real-world risks: delivery of web shells, stealers, backdoors, tampering with integrity checks, and potential data staging/exfiltration from excluded paths.