Back to CVE Browser

CVE-2020-8260

🔥 Known Exploited (CISA KEV)HIGH

7.2

CVSS Severity Score

EPSS Score31.3020%

EPSS Percentile95.54th

Published2020-10-28

Last Modified2025-12-18

Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.

Affected Platforms (CPE)

📦

Ivanti

Connect Secure

<= 9.0= 9.1

References & Advisories

🔗 http://packetstormsecurity.com/files/160619/Pulse-Secure-VPN-Remote-Code-Execution.html

🔗 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601

🔗 http://packetstormsecurity.com/files/160619/Pulse-Secure-VPN-Remote-Code-Execution.html

🔗 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8260

Related Vulnerabilities

CVE-2026-167284.8

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the applic...

CVE-2026-132687.8

G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local atta...

CVE-2026-672017.7

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers...

CVE-2026-598986.3

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attack...