Back to CVE Browser

CVE-2020-8218

🔥 Known Exploited (CISA KEV)HIGH

7.2

CVSS Severity Score

EPSS Score28.1580%

EPSS Percentile95.35th

Published2020-07-30

Last Modified2025-10-30

Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

Affected Platforms (CPE)

📦

Ivanti

Connect Secure

<= 9.0= 9.1

📦

Ivanti

Policy Secure

= 9.1

📦

Pulsesecure

Pulse Policy Secure

<= 9.0

References & Advisories

🔗 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516

🔗 https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure/

🔗 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516

🔗 https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure/

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8218

Related Vulnerabilities

CVE-2026-167284.8

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the applic...

CVE-2026-132687.8

G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local atta...

CVE-2026-672017.7

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers...

CVE-2026-598986.3

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attack...