CVE-2021-22899: Ivanti Pulse Connect Secure Command Injection Vulnerability

High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 22.9% chance of exploitation in the next 30 days.

A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature

Affected products

• Ivanti Connect Secure: version 9.0 only; version 9.1 only

Published 2021-05-27. Last modified 2026-06-17.