---
id: "CVE-2020-8218"
kind: "vulnerability"
aliases: ["CVE-2020-8218"]
title: "Pulse Secure Pulse Connect Secure: Pulse Connect Secure Code Injection Vulnerability"
severity: "critical"
cvss: 7.2
epss: 0.3225
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Pulse Secure Pulse Connect Secure", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Pulse Connect Secure", "fixed": ["9.1R8"], "affected": "< 9.1R8", "ecosystem": "vendor"}, {"name": "Pulse Policy Secure", "fixed": ["9.1R8"], "affected": "< 9.1R8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ivanti-connect-secure", "pulse-connect-secure", "self-hosted", "vendor", "vpn-appliance"]
not_affected_if: ["managed-hosting", "not-pulse-connect-secure"]
published_at: "2020-07-30T13:15:11+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-8218", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-8218", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:24:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8218", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Pulse Secure Pulse Connect Secure: Pulse Connect Secure Code Injection Vulnerability

Command injection in downloadlicenses.cgi of the Pulse Connect Secure (and Policy Secure) admin web interface lets an authenticated admin run arbitrary code. Because reflected XSS bugs (CVE-2020-8238, and one in the same endpoint) exist, an attacker can trick a logged-in admin into triggering it via a link. CVSS 3.1 AV:N/PR:H (NVD 7.2 high). Fixed in 9.1R8 (Vendor advisory SA44516, July 2020). On CISA KEV since 2022-03-07; CISA SSVC marks exploitation as active.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Pulse Secure Pulse Connect Secure affected ? fixed ?
- vendor:Pulse Connect Secure affected < 9.1R8 fixed 9.1R8
- vendor:Pulse Policy Secure affected < 9.1R8 fixed 9.1R8

## How to check

In the admin console go to System > Maintenance > Version (or the Pulse Secure admin dashboard) and read the PCS/PPS version. Anything earlier than 9.1R8 (all 9.0 and older, and 9.1R1 to 9.1R7) is affected. Also check whether /dana-admin/ is reachable from the internet; if so, restrict it to a management network. Exposure from the internet is not confirmed by the sources.

## Fix

Upgrade Pulse Connect Secure (and Policy Secure) to 9.1R8 or later; later releases such as 9.1R9 fix further bugs, so prefer the latest 9.1R release. Restrict admin interface access to a management network and rotate admin credentials if the appliance was exposed unpatched.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-8218
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-8218
- 2026-10-23T21:24:52+00:00 analyst — Vendor KB SA44516 would not load (JS-only), so fixed version taken from NVD (cites SA44516), CERT-FR, Tenable: fixed in 9.1R8. GoSecure gives root cause (downloadlicenses.cgi in admin portal). Exposure of admin interface to the internet not determinable from sources; exploitation per CISA KEV/SSVC; no standalone PoC link beyond GoSecure writeup.
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-8218

## Documents

- [advisory] NVD CVE-2020-8218 (cites vendor SA44516) https://nvd.nist.gov/vuln/detail/CVE-2020-8218
- [advisory] CERT-FR CERTFR-2020-AVI-463 (summarises SA44516) https://cert.cyber.gouv.fr/avis/CERTFR-2020-AVI-463
- [describes] GoSecure: Forget Your Perimeter Part 2 (CVE-2020-8218 technical analysis) https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure/
- [fix] Tenable: Pulse Connect Secure < 9.1R8 (SA44516) https://www.tenable.com/plugins/nessus/139225

## From the sources

A code injection vulnerability exists in Pulse Connect Secure that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_