CVE-2020-8218

Name: CVE-2020-8218
Creator: NVD / NIST
Published: 2020-07-30T13:15:11.847+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.2/10Actively ExploitedEPSS 32.74%

Last modified Jun 17, 2026

CVE-2020-8218 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.. CISA has confirmed active exploitation in the wild. EPSS estimates a 32.74% chance of exploitation in the next 30 days.

Description

A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

Metrics

CVSS 3.1

7.2/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

32.74%

98.1th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by Sep 7, 2022.

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Ivanti	Connect Secure	<= 9.0
Ivanti	Connect Secure	9.1
Ivanti	Policy Secure	9.1
Pulsesecure	Pulse Policy Secure	<= 9.0

References

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516Vendor Advisory
https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure/Exploit, Third Party Advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516Vendor Advisory
https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure/Exploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8218US Government Resource

Timeline

Published: Jul 30, 2020
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2020-8218?

A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

How severe is CVE-2020-8218?

CVE-2020-8218 has a CVSS score of 7.2/10 (HIGH severity). The EPSS model estimates a 32.74% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2020-8218?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-8218?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST