7.2 High Exploited

CVE-2020-8218 Pulse Connect Secure Code Injection Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-94

Description

A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

Affected products and versions

Product	Affected versions	Fixed in
Pulse Connect Secure	Versions not published

References

kb.pulsesecure.net kb.pulsesecure.net
www.gosecure.net www.gosecure.net

Timeline

Published July 30, 2020
Added to the KEV catalogue March 7, 2022
Last modified October 21, 2025

The 21 CVEs of Pulse Connect Secure →

CVE-2021-22965 A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a… Not rated CVE-2021-22937 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write… Not rated CVE-2021-22936 A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack… Not rated CVE-2021-22935 A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command… Not rated

Track this CVE