Ivanti · Pulse Connect Secure
CVE-2020-8243
Ivanti Pulse Connect Secure Code Execution Vulnerability
What it is
A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to upload custom template to perform an arbitrary code execution.
CISA: Ivanti Pulse Connect Secure contains an unspecified vulnerability in the admin web interface that could allow an authenticated attacker to upload a custom template to perform code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- September 29, 2020
- Severity
- High 7.2 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 91% in the top 0.2% of all known vulnerabilities
- Weakness
- CWE-94
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Ivanti
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Code Execution | Pulse Connect Secure | High 7.2 | 96% |
| Nov 3, 2021 | Arbitrary File Read | Pulse Connect Secure | Critical 9.9 | >99.9% |
| Nov 3, 2021 | Use-After-Free | Pulse Connect Secure | Critical 10.0 | 47% |
| Nov 3, 2021 | Collaboration Suite Buffer Overflow | Pulse Connect Secure | High 8.8 | 41% |
| Nov 3, 2021 | Command Injection | Pulse Connect Secure | High 8.8 | 23% |
| Nov 3, 2021 | Unrestricted File Upload | Pulse Connect Secure | High 7.2 | 14% |
| Oct 13, 2026 | Authentication Bypass by Spoofing | Connect Secure | High 8.6 | 87% |
| Jun 11, 2026 | OS Command Injection | Sentry | Critical 10.0 | 99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.