CVE-2021-22899VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-22899: Ivanti Pulse Connect Secure Command Injection Vulnerability

Affects Ivanti Pulse Connect SecureSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 22.9% chance of exploitation in 30 days – higher than 97% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

Description

Ivanti Pulse Connect Secure contains a command injection vulnerability (CVE-2021-22899) that allows remote authenticated users to execute arbitrary code via Windows File Resource Profiles. This vulnerability has been exploited in the wild and is considered high severity.

Summary

CVE-2021-22899 is a command injection vulnerability in Ivanti Pulse Connect Secure. It enables remote authenticated users to perform remote code execution by exploiting Windows File Resource Profiles. The vulnerability has been confirmed to be exploited in the wild, indicating active threat activity targeting affected systems.

Impact

Successful exploitation allows remote authenticated attackers to execute arbitrary commands on the affected system, potentially leading to full system compromise. This can result in unauthorized access, data theft, or disruption of services.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Pulse Connect Secure interfaces to trusted users and networks, and monitor for suspicious activity related to Windows File Resource Profiles.

Weaknesses

CWE-77Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:56:33 UTC

Weaknesses

References

Related threats