Pulse Connect Secure VPN Windows Resource Profiles Remote Code Execution Vulnerability Advisory (CVE-2021-22899)
Executive & SecOps Summary
SECOPS ASSESSMENTPulse Connect Secure (PCS) versions prior to 9.1R11.4
A remote authenticated attacker can exploit the Windows Resource Profiles feature to execute arbitrary commands with root privileges on the VPN gateway, potentially compromising the internal network
Immediately upgrade Pulse Connect Secure to version 9.1R11.4 or higher, apply the official XML workaround template, and perform compromise assessment
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to upgrade the Pulse Connect Secure appliance to version 9.1R11.4 or later. Download the official upgrade package (.pkg) from the Ivanti support portal and apply it via the admin console.
2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, import the official XML workaround template provided by the vendor to disable the vulnerable Windows Resource Profiles feature. Additionally, restrict administrative access to trusted IP ranges.
# [Hardening] Restrict access to the admin portal using firewall rules (Example for upstream firewall/router)
# Allow admin access only from the secure management subnet
iptables -A INPUT -p tcp -s 10.50.10.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP3. Log Audit & IoC Verification Commands
Inspect system logs and active processes to detect potential exploitation attempts or unauthorized web shells.
# 1. Check for suspicious active processes running under the web server context
ps -aux | grep -E 'sh|bash|perl|python|nc' | grep -v grep
# 2. Scan web access logs for suspicious characters in Windows Resource Profile endpoints
grep -i 'WindowsResource' /var/log/web_server_access.log | grep -E '(\;|\||\`|\$)'Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A command injection vulnerability exists in Pulse Connect Secure (PCS) before version 9.1R11.4. The root cause lies in the improper validation and sanitization of user-supplied input within the 'Windows Resource Profiles' feature. When the system processes specific configuration parameters, it passes them directly to the underlying operating system shell without adequate escaping, allowing command injection.
2. Exploitation Mechanics & Attack Scenario
An attacker must first authenticate to the PCS gateway to obtain a valid session. Once authenticated, the attacker sends a crafted request containing shell metacharacters (such as ';', '|', or backticks) through the Windows Resource Profiles configuration interface or API endpoints. The backend system executes these inputs with administrative (root) privileges, enabling the attacker to establish a reverse shell, write web shells, or modify system configurations.
3. Infrastructure & Business Impact
As Pulse Connect Secure serves as the primary gateway to enterprise internal networks, compromise of this device is critical. This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation by threat actors. Successful exploitation allows attackers to bypass perimeter security, perform lateral movement within the internal network, harvest Active Directory credentials, and deploy ransomware.
Official Vendor Advisories & References
A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature
Frequently Asked SecOps Questions (CVE-2021-22899)
FAQQ1. How critical is CVE-2021-22899 and is it actively exploited in the wild?
CVE-2021-22899 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 22.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-22899?
Primary impacted vendors include pulsesecure, ivanti across pulse_connect_secure. Scope summary: All Pulse Connect Secure (PCS) versions prior to 9.1R11.4 (9.1R1 through 9.1R11.3)
Q3. What temporary mitigations or workarounds exist for CVE-2021-22899 before patching?
[Mitigation] Immediately upgrade Pulse Connect Secure to version 9.1R11.4 or higher, apply the official XML workaround template, and perform compromise assessment Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-22899
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (pulsesecure)
View Category →Ivanti Sentry OS Command Injection and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-10520)
[Affected Scope] Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1
Ivanti Connect Secure (ICS) Authentication Bypass and Remote Code Execution (RCE) Advisory (CVE-2026-104935)
[Affected Scope] Ivanti Connect Secure (ICS) versions prior to 25.1.3.0 (excluding 22.7R2.14 and earlier)
Ivanti EPMM (Endpoint Manager Mobile) Remote Code Execution Vulnerability Advisory (CVE-2026-6973)
[Affected Scope] Ivanti EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1
Ivanti Connect Secure Local Privilege Escalation Vulnerability (CVE-2026-111357)
[Affected Scope] Ivanti Connect Secure 22.8R2.4 and prior versions.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.