Pulsesecure: community verdicts

3 notable / known-exploited Pulsesecure CVEs the community has triaged.

ⓘ Not an exhaustive list: we focus on the findings that matter (exploited / notable). For every Pulsesecure CVE, see NVD ↗.

Tracked Pulsesecure CVEs by year published3 tracked · select a year for details

Show as table

Year published	CVEs	In CISA KEV
2019	1	1
2020	1	1
2021	1	1

Exploitation first, with newly exploited CVEs rising above old ones

CVE-2019-11539HIGH 7.2KEVEPSS 99%
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
CVE-2020-8218HIGH 7.2KEVEPSS 32%
A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
CVE-2021-22900HIGH 7.2KEVEPSS 14%
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.