How do you patch or mitigate CVE-2021-22899 (Ivanti Pulse Connect Secure Command Injection)?

CISA’s required action for CVE-2021-22899 is to apply updates per vendor instructions. In practice, find every instance of Ivanti Pulse Connect Secure in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What patching CVE-2021-22899 means in practice

For this Ivanti Pulse connect secure command injection flaw, the decision is not just “apply a patch.” You need to confirm every exposed appliance, apply the vendor security update or the documented mitigation, and then validate that the device is no longer reachable from the internet if a fix cannot be installed. If the product is no longer supportable, retirement is the safer outcome.

Because this is an edge access product, remediation should be handled as an availability and trust-boundary change, not a routine desktop patch. The system is sitting in front of remote access traffic, so the first job is to reduce exposure before you assume the update alone has closed the risk. That is why the most useful supporting guidance is the broader VPN Security Guide, which frames patching, hardening, and replacement as part of the same response.

How to confirm exposure and choose the right response

Start by locating every Pulse Connect Secure instance in production, lab, and any forgotten edge segment. Appliances that are internet-facing or reachable through partner networks deserve immediate triage because command injection flaws are typically exploitable without an internal foothold. Where the vendor instructions call for a specific mitigation rather than a full update, use that only as a temporary bridge and track it as an exception.

If the appliance can be updated, treat that as the preferred path. If it cannot be updated in time, remove direct internet exposure, place it behind a stronger access control layer, or take it out of service. For teams managing remote access as a whole, the same containment logic applies in the Remote Access Identity Guide, especially where VPN access is still the primary entry point for users and third parties.

How to check for earlier compromise after remediation

This CVE was exploited in the wild, so patching is only the first half of the job. Review authentication, admin, and device logs for unusual logins, strange configuration changes, new accounts, unexpected tunnels, or activity that does not match normal remote-access patterns. Pay special attention to signs that the appliance was used as a stepping stone into internal systems, because the value of this flaw is often the initial access it can provide.

When you are prioritising what to hunt first, use the same mindset you would use for a broader exploitation response. The Vulnerability Management Guide is useful here because it ties remediation to verification, exceptions, and post-fix confirmation rather than treating patching as complete on install alone. If you find evidence of compromise, rebuild or reimage the appliance according to vendor guidance instead of assuming cleanup is sufficient.

Risk and Threat Considerations

An exposed command injection flaw on a VPN appliance can give an attacker a direct path into the trust boundary that protects remote access. That matters because the appliance often holds session context, authentication state, and network reachability that can be abused before defenders notice.

Failure mechanism: Attackers exploit the injection point to execute commands on the appliance, then use that position to harvest credentials, pivot internally, or alter access settings to preserve access.

Impact: The likely outcomes are remote code execution, unauthorized access to internal resources, credential theft, and the possibility of a persistent foothold on a device that sits in front of many users.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Command injection remediation depends on timely identification and fixing of exposed appliances.
	CIS-12 — Network Infrastructure Management	VPN appliances are edge infrastructure whose exposure must be reduced when patching is delayed.
Recommendation — Prioritise and verify remediation for internet-facing appliances before normal patch cycles. Limit direct exposure to the appliance and remove unnecessary access paths.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The issue requires applying vendor updates or mitigations and validating remediation.
	RA-5 — Vulnerability Monitoring and Scanning	You must identify all affected appliances and confirm exposure before and after mitigation.
	AU-6 — Audit Record Review, Analysis, and Reporting	Post-patch log review is needed to detect signs of earlier exploitation.
Recommendation — Apply the vendor fix or mitigation and track remediation to closure. Inventory all instances and rescan to confirm the flaw is no longer reachable. Review appliance and authentication logs for indicators of compromise.

Practitioner Guidance

What to prioritise: Patch or isolate every internet-facing appliance first, then move to internal or partner-reachable instances. If you cannot patch quickly, treat the device as exposed infrastructure and reduce reachable surface area immediately.

What to verify: Confirm that the vendor update or mitigation actually applies to the exact appliance build in your estate, and verify that no management interface or remote portal remains unnecessarily exposed after the change.

Decision rule: If the appliance is business-critical but cannot be trusted after exploitation, favour controlled replacement over prolonged exception handling. A compromised edge device is often more dangerous than a temporarily unavailable one.

Practitioner takeaway: The goal is not simply to close CVE-2021-22899, but to decide whether the appliance can still be trusted as a remote-access boundary after remediation and hunting are complete.