CVE-2021-22894: Pulse/Ivanti Connect Secure buffer overflow, authenticated RCE as root
The short version: CVE-2021-22894 is a buffer-overflow flaw in Pulse Connect Secure (now Ivanti Connect Secure) that lets a remote authenticated attacker execute arbitrary code as root on the appliance. The authentication requirement keeps it a notch below the unauthenticated Ivanti flaws, but root on a perimeter VPN is severe, and it's in CISA's KEV catalog. Patch it. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — root-level RCE, but gated behind an authenticated session |
| CVSS v3.1 (NVD) | 8.8 — High · AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~41.3% · 98.52nd percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-05-03 |
| Known exploited? | Yes — listed in CISA KEV |
| Vulnerability type | CWE-94 code injection (buffer overflow) → arbitrary code execution as root |
| Requires authenticated session? | Yes — remote authenticated attacker |
| Affected | Pulse Connect Secure before 9.1R11.4 |
| Fixed in | 9.1R11.4 (and later) |
What you need to know
CVE-2021-22894 is a memory-corruption flaw reached through a maliciously crafted meeting room. An authenticated attacker overflows a buffer and gains code execution as the root user — full control of the appliance.
The honest framing:
- It needs a valid session. Unlike the unauthenticated Pulse/Ivanti bugs, this one requires the attacker to authenticate first, which raises the bar for initial use.
- But the ceiling is root. Once triggered, it's complete compromise of a perimeter VPN — the device that terminates remote access into your network.
- It's KEV-listed. CISA has confirmed it belongs in the Known Exploited Vulnerabilities catalog, so it's not merely theoretical, and it's often paired with a separate way in.
How serious we see it
High — serious ceiling, moderated by the authentication requirement.
Root-level code execution on a VPN appliance is as bad as post-access outcomes get, which is why this isn't a low rating. What holds it at High rather than Critical is that it expects an authenticated session — an attacker needs credentials or another bug to reach it. On an appliance where credential-stealing flaws have also existed, that bar is not always high, so patch it promptly. The reassuring part is that it's narrow and long-fixed: one build closes it.
Recommendations
Straight from Pulse Secure's / Ivanti's advisory and CISA:
- Patch now (or replace). Upgrade to 9.1R11.4 or later; given the age, moving to a current supported release is the better path.
- Rotate credentials if you were exposed. If the appliance ran unpatched and internet-facing, reset appliance and account credentials and keys.
- Hunt for prior use. Review appliance and authentication logs for anomalous administrative activity.
- Harden exposure. Restrict who can reach the gateway; keep the management interface off the public internet.
- Confirm your exposure first. Verify whether any internet-facing Pulse/Ivanti Connect Secure appliance is below 9.1R11.4.
How BreachRisk sees it
BreachRisk discovers internet-facing Pulse/Ivanti Connect Secure interfaces from little more than your domain, fingerprints the build, and flags version-based exposure to KEV-listed vulnerabilities like this one — surfaced with priority because it's in KEV. It reports what it can see from the outside: an exposed, affected appliance. It does not attempt authenticated exploitation, so this is discovery and flagging, not proof of code execution.
That continuous, outside-in view keeps aging VPN appliances — the ones easy to forget — mapped and prioritized before an attacker gets there first.