Examples of valid upgrade paths:
9.9 -> 9.9r3
9.9 -> 17.2r2
9.9 -> 18.1
9.9 -> 20.1
Basically, with software installs there is usually no restriction on upgrading from one version to another, except for versions earlier than 7.0, which require upgrading to 17.3, then to the latest (20.1 at the time of writing).
Appliances (physical, virtual & cloud):
Condition 1: current version is 18.2 or later
Upgrade directly to the target release, as with Software installs.
Example: 18.2 -> 19.2r2 (does not need to go via 19.2)
Example: 18.2 -> 20.1
Condition 2: current version is between 9.9 and 18.1 inclusive, and the target version is a maintenance (X.Y.rN) release
Upgrade via the latest feature release, then to the maintenance release.
Example: 9.9 -> 19.2 -> 19.2r2
The reason for conditions 1 and 2 is that there are 2 root partitions on the VA. Before 18.2, upgrading to a maintenance release (X.YrN) involved installing the new maintenance release into the same root partition as the feature release (X.Y), hence that feature release was required first. As of 18.2 and later, upgrading to a maintenance release involves installing it into the other root partition, in the same way as feature release upgrades always have, so they no longer require the previous feature release. A feature release of 18.2 or later is still required (hence, 9.9 -> 18.2 -> 19.2r2 is also a valid path).
Condition 3: current version is between 9.9 and 18.1 inclusive, and the target version is a feature (X.Y) release
Upgrade directly to the release.
Example: 9.9 -> 20.1
Condition 4: current version is earlier than 9.9
Do a fresh install of the target version. See https://community.pulsesecure.net/t5/Pulse-Secure-vADC/Upgrading-and-reinstalling-SteelApp-Traffic-Manager-Virtual/ta-p/32981 for full details. This is required even if you have the larger root partition size added in version 9.7.
Condition 5: Current version is earlier than 11.0, and it is an Amazon cloud (EC2) AMI
Do a fresh install, as condition 4.