According to Threat intelligence firm Bad Packets, at least 3 825 Pulse Secure VPN servers remain unpatched and vulnerable to attack as of January 3 2020. Despite warnings, substantially large number of Pulse Secure's affect products remain unpatched and vulnerable to attacks. Both the NSA and the US Department of Homeland Security have issued separate advisories on VPN flaws and warn about nation-state-back advanced persistent Threat groups exploiting them to take control of vulnerable Systems. Exploits for Vulnerability have been freely available since at least last August. Pulse Secure and numerous others have repeatedly urged organizations with vulnerable systems to apply the patch as soon as possible. Flaws like these are considered especially dangerous because they exist in products that enterprises rely on for protection against cyber threats.

Attackers can use flaws to view logs and files, turn-off multifactor authentication, download arbitrary files, and execute malicious code on Enterprise Networks, Security Vulnerability is one of several that were discovered last year in VPN products from Pulse Secure, Palo Alto Networks, and Fortinet. Flaw in multiple versions of Pulse Connect Secure and Pulse Policy Secure give Remote attackers way to connect via HTTPS to Enterprise Network without needing any valid username or password. Do not delay as the CVE-2019-11510 Vulnerability is highly critical, he Warn. Pulse Secure publicly provided patch fix on Apthat should be immediately applied to Pulse Connect Secure, said Scott Gordon, chief marketing officer at Pulse Secure. UK Security researcher Kevin Beaumont, who first reported attacks on Saturday, describes at least two organizations as having been compromised so far by recent attacks targeting Pulse Secure VPN flaw. Travelex did not respond immediately to Dark Reading requests seeking an update on the incident. Attack, involving use of ransomware know as REvil, force companies to take all of their systems offline and to resort to manual operations at branches worldwide. Among those believed affected by the ongoing campaign is travel insurance and Currency Exchange provider Travelex, which experienced massive service disruption this week following a reported ransomware attack on its systems on New Year's Eve. Advice stems from reports over the last few days of attackers exploiting flaw tracked as CVE-2019-11510 to deliver ransomware on Enterprise Systems and to delete data backups and disable endpoint Security tools. The company issued a patch last April to address a critical, remotely executable flaw in some versions of its products. VPN provider Pulse Secure on Monday urged customers to immediately apply security patch if they have not yet done so.

Juniper pulse secure