CVE-2021-22899

Ivanti Pulse Connect Secure suffered a command injection vulnerability allowing remote authenticated users to execute arbitrary code via Windows File Resource Profiles.

This command injection flaw in Ivanti Pulse Connect Secure enabled remote code execution for authenticated users, directly violating CMMC/NIST 800-171 requirements for preventing unauthorized access and ensuring system integrity. DIB organizations must verify their Ivanti deployments are patched, as this vulnerability was actively exploited in the wild and represents a severe compliance gap if left unaddressed.

Shame score — A known command injection vulnerability in a widely deployed security product was actively exploited in the wild, indicating negligent patching and a failure to protect critical infrastructure.