CVE-2021-22900: Pulse Connect Secure admin file upload leads to code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityThe flaw yields code execution on a network edge device and is in CISA KEV, but it requires a valid administrator account, which limits who can trigger it.

What it is

Pulse Connect Secure before 9.1R11.4 allows an authenticated administrator to upload a maliciously crafted archive through the administrator web interface, resulting in unrestricted file writes. Because the written files can be executed, this crosses from file upload into code injection on the appliance. It matters because Pulse Connect Secure is a remote-access gateway, so compromise of the device exposes the protected network.

Impact

An attacker with administrator access gains the ability to write arbitrary files and achieve code execution on the gateway, giving full control of the appliance and a foothold into the networks it brokers access to.

Attack surface

Reached over the network through the administrator web interface; the CVSS vector (AV:N/PR:H/UI:N) indicates a valid administrator account is required and no user interaction is needed.

Exploitation

Listed in CISA KEV since 2021-11-03 with a required action to apply vendor updates, indicating exploitation in the wild; EPSS 30-day probability is about 14 percent (96th percentile). No ransomware campaign use is recorded.

What to do

• Upgrade Pulse Connect Secure to 9.1R11.4 or later per the vendor advisory.
• Restrict administrator web interface access to trusted management networks and disable it from the public internet.
• Enforce strong unique credentials and MFA for all administrative accounts to limit abuse of the required admin privilege.
• Audit and remove unnecessary administrator accounts, and review recent admin logins and uploads for anomalies.
• If patching is delayed, monitor or block archive uploads through the admin interface.

Detection

• Alert on archive file uploads (.zip, .tar, .gz and similar) submitted through the Pulse Connect Secure administrator interface.
• Monitor for new or modified executable files in web-accessible or system directories on the appliance.
• Review administrator authentication logs for unexpected logins, especially from unfamiliar source IPs.
• Hunt for post-exploitation activity such as new scheduled tasks, web shells, or outbound connections from the gateway.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.