CVE-2020-8218
Published 2020-07-30 · Updated 2026-06-17 · Source support@hackerone.com
Summary
CVE-2020-8218 is a high-severity (CVSS 7.2) vulnerability in Pulse Secure Pulse Connect Secure. CISA added it to the Known Exploited Vulnerabilities catalog on March 7, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 7, 2022. CISA does not currently list it as used in ransomware campaigns.
All 1 known-exploited Pulse Secure vulnerabilities →Description
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Pulse Secure — Pulse Connect Secure
Name: Pulse Connect Secure Code Injection Vulnerability
Date added: 2022-03-07 · Due: 2022-09-07
Required action: Apply updates per vendor instructions.
References
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
- https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure/
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
- https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8218