CVE-2020-13162

HIGH

Pulse Secure Client <9.1.6-5.3 R70 - Privilege Escalation

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-13162. PoCs published by redtimmy.

AI-analyzed exploit summary This is a working privilege escalation exploit for Pulse Secure Windows Client <9.1.6 (CVE-2020-13162). It leverages a TOCTOU (Time-of-Check Time-of-Use) race condition to replace a verified MSI file with a malicious one, achieving local privilege escalation.

Description

A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as NT AUTHORITY/SYSTEM) allows unprivileged users to run a Microsoft Installer executable with elevated privileges.

Exploits (1)

nomisec WORKING POC 10 stars

by redtimmy · poc

https://github.com/redtimmy/tu-TOCTOU-kaiu-TOCMEU-CVE-2020-13162-

View Code ZIP pw:eip

This is a working privilege escalation exploit for Pulse Secure Windows Client <9.1.6 (CVE-2020-13162). It leverages a TOCTOU (Time-of-Check Time-of-Use) race condition to replace a verified MSI file with a malicious one, achieving local privilege escalation.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Moderate

Reliability

Racy

Target: Pulse Secure Windows Client <9.1.6

No auth needed

Prerequisites: Presence of Pulse Secure Windows Client <9.1.6 · Ability to execute code on the target system · Malicious MSI file ('evil.msi') · PulseSecureInstallerService.exe binary

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1548.002 - Bypass User Account Control

mistral-large-3 · analyzed Feb 16, 2026 Full analysis →