Is CVE-2021-22900 (Ivanti Pulse Connect Secure Unrestricted File Upload) being exploited in the wild?

What this means operationally for Pulse Connect Secure

CVE-2021-22900 matters because it is not just a generic upload flaw, it is a path to file write on a remote access appliance that often sits on a high-trust boundary. In practice, that makes exposure more urgent than a typical web app bug. The right first question is whether the appliance is internet reachable and whether the administrator interface is available to any account that could be abused.

Because the issue is in archive handling through the admin web interface, defenders should think about administrative reach, not only end-user traffic. A flaw like this can be exploited only after an attacker obtains suitable access, but once that happens the device can become a staging point for web shells, persistence, or further compromise of the VPN service.

For a broader view of the control environment around remote access appliances, the VPN Security Guide is the best NHIMG home reference, and it is useful here because appliance hardening, patch urgency, and replacement planning all become part of the response when a VPN edge device is actively exploited.

How to confirm exposure and reduce the attack window

The immediate task is to confirm whether any Ivanti Pulse Connect Secure instance is present, whether it is exposed to the public internet, and whether it is still in a version range the vendor says is affected. For active exploitation questions, version confirmation should be paired with access review, because an authenticated admin path changes the likelihood of abuse and the likely attacker workflow.

Where patching or mitigation has not yet been completed, treat the system as a potentially monitored target rather than a passive vulnerability. Isolate administrative access as tightly as possible, restrict who can reach the admin interface, and look for signs of anomalous uploads, new files in web-accessible locations, unexpected configuration changes, or processes that indicate a dropped payload. If the appliance supports logging sufficient to reconstruct admin activity, preserve it before making disruptive changes.

For remediation workflow, the Vulnerability Management Guide is the most relevant NHIMG companion because it covers KEV-driven prioritisation, verification, exceptions, and remediation evidence for actively exploited issues. The vendor advisory and the CISA KEV catalogue should remain the authoritative sources for exact version and patch instructions.

Authoritative tracking for the exploit status should also come from the CISA Known Exploited Vulnerabilities Catalog, which is the operational signal that exploitation has crossed from theoretical to observed.

What to do after remediation, and what to check if compromise is suspected

Once the fix or vendor-directed mitigation is in place, review the appliance as if an attacker may already have used it. That means checking for unfamiliar administrator actions, newly written files, altered archives, modified web content, and outbound connections that do not fit normal VPN appliance behaviour. If the device was reachable during the exploitation window, the investigation should not stop at the patch line.

If evidence suggests the flaw was used, rotate any credentials, keys, or sessions that could have been exposed through the appliance, especially administrative accounts and any credentials stored or handled on the device. In a remote access product, the blast radius can extend beyond the appliance itself if the attacker pivoted into internal systems or used the device as an authentication foothold.

The Zero-Day and Exploited Vulnerabilities Guide is useful here because it frames the right sequence for emergency mitigation, compromise assessment, and post-patch hunting when exploitation is already happening in the wild. For this class of issue, the practical question is not only “is it patched?” but also “was it used before we contained it?”

Practitioner Guidance: Prioritise containment and evidence preservation before normal change windows, because exploited edge appliances often need both rapid remediation and a compromise review.

What to verify: Confirm appliance inventory, exposure, admin access paths, and whether the vendor’s fix or mitigation has actually been applied on every instance, not just the primary one.

Decision rule: If the appliance is internet-facing and could have been reached during the KEV window, treat it as a candidate compromise until logs and file-system checks support the contrary.

Practitioner takeaway: For an actively exploited VPN appliance flaw, the useful unit of work is not “patch the CVE,” it is “close the exposure, hunt for prior use, and assume the remote access boundary may already have been tested.”

Related resources from NHI Mgmt Group

• CVE-2021-22900 (Ivanti Pulse Connect Secure Unrestricted File Upload)
• Is CVE-2021-20022 (SonicWall Email Security Unrestricted Upload of File) being exploited in the wild?
• Is CVE-2021-26828 (OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type) being exploited in the wild?
• Is CVE-2024-7694 (TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type) being exploited in the wild?