CVE-2021-22900 is an unrestricted file upload vulnerability in Ivanti Pulse Connect Secure. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What this vulnerability means in practice
An unrestricted file upload flaw is dangerous because it can let an attacker place content on the appliance that the product never meant to accept, store, or execute. On an internet-facing remote access gateway, that can become a direct path from a web request to server-side control.
For affected remote access platforms, the core concern is not simply “a bad upload form”, but the trust boundary it breaks. If the device accepts attacker-supplied files without strong type, path, and execution controls, the appliance itself can become the foothold. That is why vulnerabilities of this kind are treated as high priority when they appear in perimeter products.
Why this is especially dangerous on remote access appliances
Products like Pulse Connect Secure sit at a sensitive point in the environment: they mediate access into internal systems and often hold session material, credentials, configuration data, and trusted integration paths. When an attacker can abuse file upload handling on such a device, the impact can extend far beyond the original bug.
The danger is amplified because compromise of a remote access appliance can create a bridge into privileged internal workflows. Even when the initial issue is “only” file upload, the downstream outcome may include web shell placement, command execution, persistence, credential exposure, or reuse of trusted access paths.
For background on how perimeter and VPN compromise often leads to credential theft and lateral movement, see Ivanti Connect Secure exploitation 2024 and Remote Access Identity Guide.
How organisations should assess exposure and reduce risk
The first question is whether the product is present, internet-exposed, and actually in use. Asset inventory matters because these devices are often deployed as standalone appliances, sometimes outside normal endpoint tooling. Organisations should verify exposed management and VPN interfaces, compare them against vendor advisories, and check whether the affected version family is still reachable from untrusted networks.
Where patching cannot happen immediately, compensating controls become important. Restrict exposure, tighten administrative access, review upload-facing functionality, and apply any vendor mitigation exactly as documented. Because this vulnerability class affects a remote access edge device, compensating controls should also consider whether adjacent services trust the appliance too broadly.
For prioritisation and verification workflows, the Vulnerability Management Guide is a useful companion, and the authoritative records are the NIST National Vulnerability Database and the CVE Program.
Detection, compromise review, and recovery priorities
Because CISA placed this CVE in the KEV catalogue, organisations should assume real-world exploitation is plausible and look for signs of post-exploitation activity, not just the vulnerable condition. Review appliance logs, uploaded files, unexpected web content, new administrative changes, abnormal outbound connections, and any evidence that the device was used as a staging point.
If exploitation is suspected, the response should include a compromise review of the appliance and of any secrets, sessions, or integration credentials that may have been reachable from it. A perimeter device compromise can outlive the original bug if attackers keep valid access material or persistence mechanisms after the patch is applied.
For broader patterns of exploited CVEs turning into credential exposure and follow-on access, see The State of NHI & AI Agent Breach Report 2026 and CWE Top 25 Guide.
Risk and Threat Considerations
This vulnerability matters because an attacker who reaches the upload path may be able to turn a web-facing appliance into a durable entry point. On systems that broker remote access, that can create disproportionate exposure compared with the simplicity of the flaw itself.
Failure mechanism: The appliance accepts attacker-controlled content without sufficient validation or containment, allowing hostile files to influence server-side behaviour or establish follow-on execution and persistence.
Impact: Successful abuse can lead to device compromise, internal network access, credential exposure, and secondary attacks against systems that trust the gateway.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Upload flaws are controlled by validating and restricting untrusted file input. |
| CM-7 — Least Functionality | Perimeter appliances should expose only the functions needed to reduce abuse from upload paths. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-exploitation review depends on log analysis for abnormal uploads and appliance misuse. | |
| Recommendation — Validate uploaded content and reject unsafe file types or paths before storage or execution. Disable unnecessary upload features, services, and executable paths on exposed appliances. Review appliance logs for suspicious uploads, file creation, and post-compromise activity. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The CVE and KEV status make exposure tracking and remediation prioritisation central to this term. |
| Recommendation — Prioritise internet-facing appliances in your vulnerability management workflow and verify remediation promptly. | ||
| OWASP ASVS | V5 — File Handling | The vulnerability is a file upload weakness, so file handling requirements directly apply. |
| Recommendation — Enforce strict file handling rules for type, size, location, and execution restrictions. | ||
Practitioner Guidance
Why practitioners should care: Treat this as an edge-device priority, not a routine web bug. Remote access appliances often sit outside normal application control paths, so vulnerability ownership, patch timing, and exposure review need explicit operational attention.
What to watch for: If the appliance is internet-facing, long-lived, or used for privileged access, verify its exposure status immediately and confirm that any documented mitigation has actually been applied. If compromise is possible, review the device as a security incident, not just a patch task.