CVE-2022-21826

score

0.4

cvss

5.4

epss

46.0% ▲0.8

published

2022-09-30

kev added

—

first seen

2026-10-21

Pulse Secure version 9.115 and below contain a client-side HTTP request smuggling caused by ignoring the Content-Length header in POST requests, letting attackers inject malicious requests that may lead to XSS, exploit requires attacker to send crafted POST requests.