CISA KEV · catalog date Nov 3, 2021 · first observed Jul 19, 2026
Evidence dossier
CVE-2021-22900
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a…
Exploited in the wild (CISA KEV since Nov 3, 2021). NVD reports CVSS 3.1 7.2. EPSS estimates 14.1% exploit likelihood as of Aug 27, 2026.
69.7–70.8Priority evidence range
As of Aug 27, 2026
Normalized restatement
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
- State
- PUBLISHED
- Published
- May 27, 2021
- Updated
- Oct 21, 2025
- Evidence coverage
- 99%
Evidence chronology
What was known when
- Source dateSource date omittedFirst observed by CASCACISA-ADPOriginal evidence ↗
Record text: CISA ADP Vulnrichment
Inspect raw assertion
- Field
container- Value
- CISA ADP Vulnrichment
- Source dateSource date omittedFirst observed by CASCACVE ProgramOriginal evidence ↗
Record text: CVE Program Container
Inspect raw assertion
- Field
container- Value
- CVE Program Container
- Source dateSource date omittedFirst observed by CASCAhackeroneOriginal evidence ↗
Record text: A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
Inspect raw assertion
- Field
container- Value
- A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
- Source dateFirst observed by CASCACISA KEVOriginal evidence ↗
Exploitation cataloged: Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
Inspect raw assertion
- Field
observed_exploitation- Value
- Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
- Source dateFirst observed by CASCAFIRST EPSSOriginal evidence ↗
EPSS score: 14.15% probability · 96.3th percentile
Inspect raw assertion
- Field
model_probability- Value
- Probability 0.141460000000; percentile 0.962970000000
FIRST EPSS · score date Aug 27, 2026 · 96.3th percentile · first observed Aug 27, 2026
NVD · CVSS 3.1 · first observed Jul 19, 2026 · same-version scores align in this snapshot
Evidence detail
Source limits and decisions
Why each evidence state has this value
Outside this view’s verified evidenceReason detail begins outside this selected snapshot; the state remains source-bound.
Source comparison
Who said what
CISA-ADPIndependent enrichment
Record text
CISA ADP Vulnrichment
Inspect raw assertion
- Field
container- Value
- CISA ADP Vulnrichment
CVE ProgramDerivative copy
Record text
CVE Program Container
Inspect raw assertion
- Field
container- Value
- CVE Program Container
hackeroneOriginal assertion
Record text
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
Inspect raw assertion
- Field
container- Value
- A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
CISA KEVOriginal assertion
Exploitation cataloged
Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
Inspect raw assertion
- Field
observed_exploitation- Value
- Ivanti Pulse Connect Secure Unrestricted File Upload Vulnerability
FIRST EPSSOriginal assertion
EPSS score
14.15% probability · 96.3th percentile
Inspect raw assertion
- Field
model_probability- Value
- Probability 0.141460000000; percentile 0.962970000000
Applicability
Cited product scope
41Underlying assertions
2Canonical products
41Target assertions
0Constraint assertions
Grouped from 1 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.
Identity source boundaries
- Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z
27d65b0f-b718-4b4f-bb79-c47c68d09dfa - Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z
955dae73-7302-438b-aee1-058d7cc5d48e
3 scope groups
hackerone · source assertedn/aPulse Secure SecureDirect source scope
Affected: Fixed in 9.1R11.4
Source-reported scopeCanonical linkage remains open; the cited source assertion is retained below.
Inspect raw assertion
[{"status": "affected", "version": "Fixed in 9.1R11.4"}]NVD CPE · APPLICATIONivanticonnect_secureVulnerable target · 40 assertions
Version 9.0; Version 9.1Canonical identity
Scope supportedproduct-0675def37879dcf14a27022586db7f5234f5d2c3f293e3a70a47a5da19da3b1bLinked exactInspect raw assertions
cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 20
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
232bab6c-d318-4f80-8f49-4e700c21f535
cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 15
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
4755bc2c-a96e-47af-9d7c-e8d44b31f10b
cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 10
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
59f4a6f7-a6d4-4517-a316-7c7c002a9ed3
cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 39
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
f54753d0-6275-4f82-b874-55438d2983b3
cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 5
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
6a708c3f-9050-4475-95b3-4785d3e2cb69
cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 29
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
0349a0cc-a372-4e51-899e-d7ba67876f4b
cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 36
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
07ab853d-5a3f-4142-8417-1c9fb729a89e
cpe:2.3:a:ivanti:connect_secure:9.0:r4.0:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 13
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
e49ff0c8-cf7b-43d2-a144-5ed73848d875
cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 31
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
3ccc2d7b-f835-45ec-a316-2f0c5f2cf565
cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 11
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
702094b0-2e5c-4a16-a8b0-f0eaf78e4ecb
cpe:2.3:a:ivanti:connect_secure:9.0:r3.0:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 7
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
105b8b46-a328-4163-82ff-f4236fca9b2d
cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 6
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
52851aaa-88fb-40bc-b41a-b821f6ba9f79
cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 1
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
d47d09a8-4ac4-4cd9-b648-5f26453e2e1d
cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 27
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
d5355372-03ea-46d7-9104-a2785c29b664
cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 3
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
59331dc5-ff5f-4bb3-905e-5a4a621f86ed
cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 18
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
4b21c181-dc49-4ebd-9932-dbb337151ff7
cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 26
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
843bc1b9-50cc-4f8f-a454-a0cec6e92290
cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 38
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
b2c10c89-1dbc-4e91-bd28-d5097b589ca9
cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 8
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
f05dc11e-7c41-450b-a2bf-603e9252bb40
cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 16
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
bf6e8a0c-192b-4f51-86aa-fc2b85657632
cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 37
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
16daa769-8f0d-4c54-a8d9-9902995605b0
cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 30
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
93d1a098-bd77-4a7b-9070-a764fb435981
cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 12
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
a369ae09-17e4-4541-a8e1-a2f4a1398ee7
cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 9
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
5da976d9-a330-475e-b8c0-09ef3e08f18d
cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 23
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
366ef5b8-0233-49b8-806a-e54f60410ade
cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 0
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
3818b543-3415-4e27-8dad-6ba9d3d9a1a5
cpe:2.3:a:ivanti:connect_secure:9.0:r2.0:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 4
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
5f87b761-02b2-4cf1-b7fe-21f92c772ff1
cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 14
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
24ef2f1a-8140-4fdb-8af4-309afaf998e1
cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 32
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
ad812596-c77c-4129-982f-c22a25b52126
cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 21
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
abd840bf-944e-4f4c-96dc-0256286338f6
cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 19
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
5aa4b39f-2fb9-4752-b1f1-18812b0990b4
cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 22
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
a1995f34-ae75-47c4-9a9d-dbb1d3e130e5
cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 35
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
dfe8fa87-9622-4d5b-99c7-d8ee230c0aa9
cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 25
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
db7a6d62-6576-4713-9bf4-11068a72e8b7
cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 24
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
4fefc4b1-7350-46f9-80c1-42f5ae06142f
cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 34
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
bffa0b02-7f6d-4434-b1e7-eb8520fd68a0
cpe:2.3:a:ivanti:connect_secure:9.0:r1.0:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 2
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
2e65c588-32e5-42fb-b1c0-de80c44a9e2e
cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 17
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
4f450898-0b06-4073-9b76-bf22f68bd14f
cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 33
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
9fa0b20d-3fa1-42ae-bdc5-93d8a182927c
cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 28
- Logic
- OR
- Version bounds
- No explicit bounds
- Match ID
3de32a0c-8944-4f51-a286-266055ca4b2f
NVD CPE · APPLICATIONpulsesecurepulse_connect_secureVulnerable target · 1 assertions
Any version (unconstrained) (<= 9.1)Canonical identity
Scope supportedproduct-3491ad74c485b34a0b140fe6de30092dd4bfe2c7f5509b45b7f948904a157af1Linked exactInspect raw assertion
cpe:2.3:a:pulsesecure:pulse_connect_secure:*:*:*:*:*:*:*:*- Official link
- Linked exact
- Role
- Vulnerable target
- Configuration
- 0 · node/0 · match 40
- Logic
- OR
- Version bounds
- through including 9.1
- Match ID
02c5a1ff-7572-4cb7-81da-9ae3c867ae67
Affected-product evidence
Accepted scope and product mapping
0 canonical links · 0 source-reported links
Applicability remains source-scoped; safety and exposure remain unassessed.
Assessments
CVSS by origin
NVDCVSS 3.1 · role Primary · priority eligiblevalid_match
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HNVDCVSS 2.0 · role Primary · priority eligiblevalid_match
AV:N/AC:L/Au:S/C:P/I:P/A:PCVE Program sourceCVSS 3.1 · role Secondary · priority eligiblevalid_match
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCISA-ADPCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibility
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HEvidence boundaries
- KEV membership is authoritative for the catalog, not proof of exposure in any environment.
- EPSS is a dated model probability and not an individual-environment prediction.
- Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
- NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
- Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
- NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
- Affected-product evidence remains source-scoped; canonical linkage is required before applicability scoring.
- Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
- OSV aggregation and OSV-converted NVD material are not independent corroboration.
- Red Hat facts are vendor assertions for the exact supplied products.
- Nonmembership and not-yet-observed states are not proof of safety.