CVE-2021-22899: Pulse Connect Secure command injection via Windows Resource Profiles

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a network-reachable authenticated RCE on an edge VPN appliance that is in CISA KEV with elevated EPSS, though it requires valid credentials.

What it is

Pulse Connect Secure before 9.1R11.4 contains a command injection flaw (CWE-77) in the Windows Resource Profiles feature. An attacker who can authenticate to the appliance can inject commands that execute on the underlying system, giving code execution on a VPN gateway that typically sits at the network edge.

Impact

A remote authenticated attacker gains remote code execution with the privileges of the affected service, allowing full compromise of confidentiality, integrity and availability of the appliance.

Attack surface

Reached over the network through the Windows Resource Profiles feature; the CVSS vector (AV:N/PR:L/UI:N) indicates a low-privileged authenticated account is required and no user interaction is needed.

Exploitation

Listed in CISA KEV since 2021-11-03 with a required action to apply vendor updates, and EPSS shows a 30-day probability of roughly 0.23 (97.6th percentile), indicating observed exploitation activity.

What to do

• Upgrade Pulse Connect Secure to 9.1R11.4 or later as directed by the vendor advisory.
• Restrict and audit accounts with access to the Windows Resource Profiles feature; remove unused or low-trust accounts.
• Limit management and administrative access to trusted networks or VPN-only paths.
• Monitor for and investigate any signs of compromise on appliances that ran a vulnerable version before patching.

Detection

• Review appliance and host logs for unexpected child processes or command execution spawned by the Pulse Connect Secure service.
• Alert on configuration changes to Windows Resource Profiles, especially from low-privileged accounts.
• Hunt for outbound connections or tooling on the appliance consistent with post-exploitation activity.
• Correlate authentication logs for unusual or newly used accounts accessing the resource profiles feature.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.