CVE-2021-22899: Ivanti Connect Secure RCE Vulnerability

CVE-2021-22899 Overview

A command injection vulnerability exists in Pulse Connect Secure (now Ivanti Connect Secure) before version 9.1R11.4 that allows a remote authenticated attacker to perform remote code execution via the Windows Resource Profiles Feature. This vulnerability affects the widely deployed VPN solution and represents a significant security risk for organizations relying on Pulse Connect Secure for remote access.

Critical Impact

This vulnerability has been confirmed as actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Authenticated attackers can leverage the Windows Resource Profiles Feature to execute arbitrary commands on vulnerable systems, potentially leading to complete system compromise.

Affected Products

• Ivanti Connect Secure versions 9.0 (all releases through 9.0R6.0)
• Ivanti Connect Secure versions 9.1 through 9.1R11.3
• Pulse Connect Secure versions prior to 9.1R11.4

Discovery Timeline

• May 27, 2021 - CVE CVE-2021-22899 published to NVD
• December 18, 2025 - Last updated in NVD database

Technical Details for CVE-2021-22899

Vulnerability Analysis

This command injection vulnerability (CWE-77) resides in the Windows Resource Profiles Feature of Pulse Connect Secure. The vulnerability allows authenticated users to inject and execute arbitrary commands on the underlying operating system through specially crafted input that is not properly sanitized before being passed to system command execution functions.

The attack requires network access and authentication to the Pulse Connect Secure appliance. Once authenticated, an attacker can exploit the Windows Resource Profiles Feature to break out of the intended application context and execute commands with the privileges of the VPN appliance. This can result in complete confidentiality, integrity, and availability compromise of the affected system.

The inclusion of this CVE in CISA's Known Exploited Vulnerabilities catalog indicates that threat actors have successfully weaponized this vulnerability in real-world attacks, making immediate patching essential for affected organizations.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization within the Windows Resource Profiles Feature. User-supplied input is incorporated into system commands without adequate filtering or escaping, allowing metacharacters and command separators to be interpreted by the command processor. This classic command injection pattern (CWE-77: Improper Neutralization of Special Elements used in a Command) enables attackers to append or inject arbitrary commands that execute with the application's privileges.

Attack Vector

The attack is executed remotely over the network. An attacker must first authenticate to the Pulse Connect Secure appliance, then navigate to the Windows Resource Profiles configuration interface. By injecting command injection payloads into vulnerable input fields, the attacker can cause the system to execute arbitrary commands. The attack does not require user interaction beyond the attacker's own actions.

The exploitation mechanism involves crafting malicious input containing shell metacharacters (such as semicolons, pipes, or backticks) that terminate the intended command and execute attacker-controlled commands. Since the vulnerability requires authentication, attackers may leverage stolen credentials, phishing attacks, or other authentication bypass vulnerabilities to gain the initial access needed for exploitation.

Detection Methods for CVE-2021-22899

Indicators of Compromise

• Unusual or unauthorized modifications to Windows Resource Profiles configurations
• Unexpected processes spawned by the Pulse Connect Secure service
• Anomalous outbound network connections from the VPN appliance
• Evidence of command execution artifacts in system logs with unusual command patterns or shell metacharacters

Detection Strategies

• Monitor Pulse Connect Secure logs for suspicious activity in the Windows Resource Profiles Feature
• Implement network detection rules for unusual traffic patterns originating from VPN appliances
• Deploy endpoint detection and response (EDR) solutions to identify post-exploitation behavior
• Review authentication logs for compromised accounts being used to access administrative functions

Monitoring Recommendations

• Enable verbose logging on Pulse Connect Secure appliances and forward logs to a SIEM
• Configure alerts for configuration changes to Windows Resource Profiles
• Monitor for indicators of lateral movement originating from VPN infrastructure
• Implement behavioral analysis to detect anomalous command execution patterns

How to Mitigate CVE-2021-22899

Immediate Actions Required

• Upgrade Pulse Connect Secure to version 9.1R11.4 or later immediately
• Review user accounts with access to Windows Resource Profiles Feature and enforce principle of least privilege
• Audit recent configuration changes and administrative actions for signs of compromise
• Consider running the Pulse Secure Integrity Checker Tool to detect potential compromise

Patch Information

Ivanti (formerly Pulse Secure) has released a security update that addresses this vulnerability. Organizations should upgrade to Pulse Connect Secure version 9.1R11.4 or later. Detailed patch information and download links are available in the Pulse Secure Advisory SA44784. Given the confirmed active exploitation of this vulnerability, patching should be treated as an emergency priority.

Workarounds

• Restrict access to the Windows Resource Profiles Feature to only essential administrative accounts
• Implement network segmentation to limit exposure of VPN management interfaces
• Deploy web application firewall rules to filter potentially malicious input to the vulnerable feature
• Consider disabling the Windows Resource Profiles Feature if not operationally required until patching can be completed

# Verify Pulse Connect Secure version
# Access the admin console and navigate to:
# Maintenance > System > Platform
# Ensure version is 9.1R11.4 or later

# Review Windows Resource Profiles access
# Navigate to: Users > User Roles > [Role Name] > Windows > File Browsing
# Audit and restrict access as appropriate