CVE-2020-8218: Pulse Connect Secure admin web interface code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a KEV-listed, publicly exploited code injection flaw with high EPSS, but exploitation requires high (admin) privileges, which limits the population of viable attackers.

What it is

Pulse Connect Secure before 9.1R8 contains a code injection flaw (CWE-94) in the admin web interface. An attacker able to craft a malicious URI can achieve arbitrary code execution on the appliance. Because the affected product is a remote-access VPN gateway, compromise can expose the internal network it protects.

Impact

An attacker gains arbitrary code execution on the Pulse Connect Secure appliance, with high impact to confidentiality, integrity and availability per the CVSS vector. On a VPN gateway this can enable credential theft, session hijacking and lateral movement into protected networks.

Attack surface

Reached over the network via a crafted URI against the admin web interface, per the CVSS vector AV:N/AC:L/PR:H/UI:N. The PR:H rating means the attacker needs high privileges, i.e. administrative access to the interface, and no user interaction is required.

Exploitation

Listed in CISA KEV since 2022-03-07 with a required action to apply vendor updates, and EPSS shows a 30-day probability of 0.32739 (98.3rd percentile). A public third-party advisory is tagged Exploit, indicating exploit code or detail is publicly available; no ransomware campaign use is documented.

What to do

• Upgrade Pulse Connect Secure to 9.1R8 or later per vendor advisory SA44516.
• Restrict network access to the admin web interface to trusted management networks and disable it from untrusted zones.
• Enforce strong, unique administrative credentials and MFA, and rotate admin credentials after any suspected exposure.
• Monitor vendor advisories and KEV for follow-up fixes, since this appliance family has a history of exploited flaws.

Detection

• Review web and appliance logs for anomalous or malformed URIs targeting admin interface endpoints.
• Alert on unexpected processes, files or outbound connections originating from the Pulse Connect Secure appliance.
• Audit admin interface authentication events for logins from unusual source IPs or at unusual times.
• Hunt for indicators published in the GoSecure advisory and any vendor IOC guidance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.