CVE-2021-22900: Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability

High severity, CVSS 7.2. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 14.1% chance of exploitation in the next 30 days.

A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.

Affected products

• Ivanti Connect Secure: version 9.0 only; version 9.1 only
• Pulse Secure Pulse Connect Secure: up to and including 9.1

Published 2021-05-27. Last modified 2026-06-17.