8.8 High Exploited

CVE-2021-22899 Ivanti Pulse Connect Secure Command Injection Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-77

Description

A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature

Affected products and versions

Product	Affected versions	Fixed in
Pulse Connect Secure	Versions not published

References

kb.pulsesecure.net kb.pulsesecure.net

Timeline

Published May 27, 2021
Added to the KEV catalogue November 3, 2021
Last modified October 21, 2025

The 21 CVEs of Pulse Connect Secure →

CVE-2021-22965 A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a… Not rated CVE-2021-22937 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write… Not rated CVE-2021-22936 A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack… Not rated CVE-2021-22935 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command… Not rated

Track this CVE