OMENWAVE modelled vulnerability-chaining pathways

CVE-2021-22900

A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.

7.2
CVSS High
14.1%
EPSS p97
YES
In CISA KEV

Data as of 2 Nov 2026 · NVD, CISA KEV, EPSS

Why chaining, at machine speed

Defenders still triage vulnerabilities one CVE at a time, while increasingly automated attackers combine them at machine speed. Omenwave models the plausible pathways by which this CVE could be chained with others — surfacing them for research and awareness, with evidence for each step.

Modelled capability profile
Kill-chain stage
EXECUTION
Requires
PRIV access, NETWORK vector
Grants
PRIV access
Capabilities
code execution
Model confidence
high · CVSS 3.1
Top plausible next hops
CVE-2024-21887EXECUTION → PRIV_ESChigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated…

CVE-2019-11539EXECUTION → EXECUTIONhigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse P…

CVE-2020-8260EXECUTION → EXECUTIONhigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution…

CVE-2020-8243EXECUTION → EXECUTIONhigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform…

CVE-2025-49704EXECUTION → EXECUTIONhigh plausibility · KEV

The access level the source grants already meets or exceeds the access level the destination requires — the position carries over.

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Open in the interactive explorer →
Embed this snapshot

Paste this into a blog post or report — it renders a compact, exploit-free chain snapshot.

Modelled plausible chaining potential derived from public CVE metadata (CVSS, CWE, CPE). Not a confirmed real-world exploit chain and contains no exploitation detail. For research and awareness only.

Methodology · Interactive explorer · JSON: /cve/CVE-2021-22900