CVE‑2021‑22899: Ivanti Pulse Connect Secure Command‑Injection Vulnerability Enables Authenticated Remote Code Execution
What It Is — Ivanti Pulse Connect Secure (PCS) contains a command‑injection flaw in its Windows File Resource Profiles handling. An attacker who has a valid PCS account can inject OS commands that the appliance executes with the privileges of the PCS service.
Exploitability — The vulnerability is remote‑authenticated; proof‑of‑concept code has been published and the CVSS base score is 9.8 (Critical). No public exploit for unauthenticated attackers is known, but any compromised credential set can be leveraged.
Affected Products — All supported versions of Ivanti Pulse Connect Secure prior to the vendor‑released patch (see Ivanti security advisory).
Why It Matters for Trust & Control Assurance
- Identity & Access Controls – The flaw shows that merely granting access is insufficient; continuous verification of privileged accounts and least‑privilege design are essential for a defensible audit trail.
- Logging & Monitoring – Successful command injection can bypass normal logging; robust, tamper‑evident logs are required to prove what actions were taken on remote‑access appliances.
- Supply‑Chain Assurance – Remote‑access gateways are a common third‑party component; demonstrating that they are patched and monitored satisfies multiple framework controls in one step.
Recommended Actions
- Deploy Ivanti’s security patch for CVE‑2021‑22899 immediately.
- Enforce multi‑factor authentication (MFA) for all PCS accounts, especially privileged users.
- Review and tighten role‑based access to PCS, applying the principle of least privilege.
- Enable detailed command‑execution logging and integrate logs into a centralized SIEM for continuous monitoring.
- Conduct a post‑patch validation test to confirm the vulnerability is mitigated.
Source: CISA KEV – CVE‑2021‑22899