CVE-2021-22899 is a command injection vulnerability in Ivanti Pulse Connect Secure. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles.
What this vulnerability means in practice
Command injection in a remote access appliance is dangerous because the appliance sits at a trust boundary, often exposed to the internet and relied on for sensitive administrative and user connectivity. When attackers can turn an authenticated request into operating system commands, the appliance can stop being a control point and become a beachhead.
That is especially important for a VPN or secure access product, because one successful exploit can sit in front of many internal systems at once. In practice, the vulnerability is not just about a single server, it is about the attacker gaining a foothold where they can reach credentials, sessions, configuration, logs, and downstream services.
Why command injection on secure access appliances is high impact
Command injection is severe when it occurs in software that mediates remote access, because the attacker may inherit the appliance’s network position and operational trust. Even when the initial requirement is authenticated access, the exploit can still be valuable to a malicious insider, a compromised account, or an intruder who has already obtained valid credentials.
The likely security consequence is remote code execution, which can lead to configuration tampering, credential theft, persistence, and further lateral movement. If the appliance stores session material or integrates with directory, certificate, or gateway functions, the blast radius can extend well beyond the vulnerable host itself.
For background on the broader class of web and edge-device injection issues, the Web Application Attacks Guide is a useful companion reference, and the Vulnerability Management Guide explains how teams should prioritise KEV-listed issues like this one.
How organisations assess exposure and confirm scope
The first question is whether the appliance exists anywhere in the estate, including branch offices, DMZs, unmanaged environments, and forgotten legacy deployments. Asset inventory matters because remote access systems are often unevenly tracked, and internet exposure makes the difference between a theoretical flaw and an active attack path.
Teams should also confirm whether the product is still reachable from the public internet, whether it is fronted by compensating controls, and whether vendor advisories and the CISA KEV catalogue indicate urgent exploitation pressure. When an issue is in KEV, exposure review should be tied to patch status, service ownership, and whether the appliance has already been touched by adversaries.
For authoritative vulnerability records, use the NIST National Vulnerability Database and the CVE Program as the canonical references for identifier and record context.
Remediation, containment, and compromise review
The preferred response is to follow the vendor advisory and apply the fix as soon as possible, but where patching is delayed, organisations should reduce exposure by restricting access paths, tightening administrative reachability, and removing unnecessary public exposure. Temporary controls do not eliminate the flaw, but they can shrink the window in which exploitation is practical.
After patching, the appliance should not be assumed clean. Command injection can leave behind altered scripts, added accounts, tampered configuration, staged binaries, or evidence of credential harvesting, so a post-patch review should include logs, filesystem changes, scheduled tasks, and any unusual outbound activity.
If compromise is suspected, rotate secrets and credentials that may have been accessible through the appliance, including privileged credentials, service credentials, tokens, and certificates that were stored, proxied, or used through the gateway.
Risk and Threat Considerations
This kind of flaw is dangerous because it combines a high-value access boundary with a direct path to operating system execution. Attackers do not need to break the network perimeter in the usual way if they can turn a trusted remote access service into an execution platform.
Failure mechanism: A valid session or authenticated foothold is abused to inject commands into the underlying system, letting the attacker execute code, modify the appliance, and pivot toward internal assets.
Impact: The result can include persistence on the gateway, theft of credentials or session material, internal reconnaissance, and follow-on compromise of systems that rely on the appliance for access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | CVE exploitation can expose credentials and sessions that IA-5 governs. |
| AC-6 — Least Privilege | Command injection on a gateway is worsened by excessive appliance privileges. | |
| SI-3 — Malicious Code Protection | Post-exploit cleanup and containment depend on detecting malicious payloads and persistence. | |
| Recommendation — Rotate exposed credentials and invalidate compromised authenticators immediately. Restrict appliance accounts and services to the minimum privileges they need. Scan the appliance for injected payloads, altered binaries, and persistence mechanisms. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | A KEV-listed appliance flaw requires prioritised discovery, remediation, and verification. |
| Recommendation — Prioritise, patch, and verify exploitation-prone vulnerabilities on exposed appliances. | ||
Practitioner Guidance
Why practitioners should care: Remote access appliances concentrate risk, so one missed vulnerability can expose many users, many sessions, and many downstream systems at once. Treat KEV-listed issues on these devices as urgent operational risk, not routine maintenance.
What to watch for: Look for unusual administrative actions, unexpected child processes, webshell-like artefacts, and signs that the appliance was used to stage later movement. A clean-looking interface does not prove a clean host after exploitation.
Practitioner takeaway: For internet-facing access infrastructure, patch priority, exposure review, and compromise verification should move together, because fixing the bug without checking for abuse leaves the hardest part undone.