CVE-2021-22899: Pulse/Ivanti Connect Secure command injection, authenticated RCE
The short version: CVE-2021-22899 is a command-injection flaw in Pulse Connect Secure (now Ivanti Connect Secure) that lets a remote authenticated attacker execute code on the appliance through the Windows Resource Profiles feature. The login requirement keeps it below the unauthenticated Ivanti flaws, but code execution on a perimeter VPN is severe, and it's in CISA's KEV catalog. Patch it. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — remote code execution, gated behind an authenticated session |
| CVSS v3.1 (NVD) | 8.8 — High · AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~22.3% · 97.42nd percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-05-03 |
| Known exploited? | Yes — listed in CISA KEV |
| Vulnerability type | CWE-77 command injection → remote code execution on the appliance |
| Requires authenticated session? | Yes — remote authenticated attacker |
| Affected | Pulse Connect Secure before 9.1R11.4 |
| Fixed in | 9.1R11.4 (and later) |
What you need to know
CVE-2021-22899 lives in the Windows Resource Profiles feature: an authenticated attacker supplies input that the appliance passes to an operating-system command, and that injection becomes code execution on the device.
The honest framing:
- It needs a valid session. The attacker must authenticate first, which raises the bar compared with the unauthenticated Pulse/Ivanti bugs.
- The impact is code execution on a perimeter VPN. Control of the appliance means control of the boundary that terminates remote access into your network.
- It's KEV-listed. CISA confirms it belongs in the Known Exploited Vulnerabilities catalog, and it was among the Pulse Connect Secure issues abused in real intrusions — frequently after a separate way in.
How serious we see it
Moderate — a serious outcome, moderated by the authentication requirement.
Remote code execution on a VPN appliance is severe, which is why this isn't a low rating. What holds it at High rather than Critical is the authenticated prerequisite: an attacker needs credentials or another bug to reach it. On an appliance line that has also had credential-disclosure flaws, that prerequisite is not always a real barrier — so patch promptly. The reassuring part is that it's narrow and long-fixed: one build closes it.
Recommendations
Straight from Pulse Secure's / Ivanti's advisory and CISA:
- Patch now (or replace). Upgrade to 9.1R11.4 or later; given the age, moving to a current supported release is the better path.
- Rotate credentials if you were exposed. If the appliance ran unpatched and internet-facing, reset appliance and account credentials and keys.
- Hunt for prior use. Review appliance and authentication logs for anomalous activity.
- Harden exposure. Restrict who can reach the gateway; keep the management interface off the public internet.
- Confirm your exposure first. Verify whether any internet-facing Pulse/Ivanti Connect Secure appliance is below 9.1R11.4.
How BreachRisk sees it
BreachRisk discovers internet-facing Pulse/Ivanti Connect Secure interfaces from little more than your domain, fingerprints the build, and flags version-based exposure to KEV-listed vulnerabilities like this one — surfaced with priority because it's in KEV. Because exploitation requires an authenticated session, BreachRisk reports the exposed, affected appliance rather than attempting exploitation: discovery and flagging, not proof of code execution.
That continuous, outside-in view keeps aging VPN appliances mapped and prioritized before an attacker finds them first.