SA45476 - Client Side Desync Attack (Informational)

Portswigger has provided a responsible disclosure of a vulnerability that affects the Pulse Collaboration feature. Their write up can be found here: https://portswigger.net/research/browser-powered-desync-attacks
Ivanti has also requested CVE-2022-21826.
The type of attack in this instance is a Client-Side Desync (CSD) Attack that requires an authenticated user and requires full control over an authenticated session.  This is possible between a client machine and the VPN (Pulse Connect Secure) server.
 

To immediately remediate this issue, upgrade the Pulse Connect Secure server to 9.1R16 or above. The Pulse Collaboration feature that is the target of this attack is not available in this release or any releases post 9.1R16.

Please refer to KB45487 for further information.