CVE-2020-8218

HIGH KEV

Pulse Connect Secure <9.1R8 - Code Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2020-8218 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 7, 2022. EIP tracks 1 public exploit from researchers including withdk.

AI-analyzed exploit summary This repository contains a functional Python-based exploit for CVE-2020-8218, a remote code execution vulnerability in Pulse Secure VPN. The exploit authenticates to the target, sends a crafted payload, and executes arbitrary commands, as demonstrated by the example usage in the README.

Description

A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

Exploits (1)

nomisec WORKING POC 22 stars
by withdk · remote-auth
https://github.com/withdk/pulse-gosecure-rce-poc

This repository contains a functional Python-based exploit for CVE-2020-8218, a remote code execution vulnerability in Pulse Secure VPN. The exploit authenticates to the target, sends a crafted payload, and executes arbitrary commands, as demonstrated by the example usage in the README.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Pulse Secure VPN (Pulse Connect Secure and Pulse Policy Secure)
Auth required
Prerequisites: Valid credentials for the Pulse Secure VPN · Network access to the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 7.2
EPSS 0.3274
EPSS Percentile 98.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2022-03-07
VulnCheck KEV 2020-12-07
InTheWild.io 2020-12-07
ENISA EUVD EUVD-2020-29091
CWE
CWE-94
Status published
Products (4)
ivanti/connect_secure 9.1 (11 CPE variants)
ivanti/connect_secure < 9.0
ivanti/policy_secure 9.1 (11 CPE variants)
pulsesecure/pulse_policy_secure < 9.0
Published Jul 30, 2020
KEV Added Mar 07, 2022
Tracked Since Feb 18, 2026