{"id":"CVE-2020-8260","published":"2020-10-28T13:15:13Z","modified":"2026-06-17T03:26:09Z","title":"Ivanti Pulse Connect Secure Code Execution Vulnerability","vendor":"Ivanti","product":"Pulse Connect Secure","tier":"core","eol":null,"description":{"text":"A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform an arbitrary code execution using uncontrolled gzip extraction.","provenance":"source","from":"NVD"},"summary":{"text":"A flaw in the admin web interface of Ivanti Pulse Connect Secure, in versions before 9.1R9, involves uncontrolled gzip extraction that allows unrestricted upload of files of dangerous type. An attacker who is authenticated over the network with administrative privileges can achieve arbitrary code execution, and no user interaction is required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:07:00Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.9648,"percentile":0.99881,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2020-8260","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-04-20","exploitedFirstSeen":"2021-04-20","ransomware":true,"evidence":[{"url":"https://us-cert.cisa.gov/ncas/alerts/aa21-110a","date":"2021-04-20"},{"url":"https://cyware.com/news/chinese-cyberspies-unc2630-targeting-us-and-eu-organizations-d94ac724/?web_view=true","date":"2021-06-03"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa21-110a","date":"2021-08-24"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://blog.checkpoint.com/security/december-2021s-most-wanted-malware-trickbot-emotet-and-the-log4j-plague/","date":"2022-01-12"},{"url":"https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/2022-unit42-ransomware-threat-report-final.pdf","date":"2022-03-24"},{"url":"https://blog.checkpoint.com/security/april-2022s-most-wanted-malware-a-shake-up-in-the-index-but-emotet-is-still-on-top/","date":"2022-05-11"},{"url":"https://ransomware.org/blog/initial-access-vectors-for-ransomware/","date":"2022-05-13"},{"url":"https://static.tenable.com/marketing/whitepapers/Whitepaper-Ransomware_Ecosystem.pdf","date":"2022-06-22"},{"url":"https://cert-in.org.in/PDF/RANSOMWARE_Report_2022.pdf","date":"2023-04-22"}],"evidenceTotal":15,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"references":[{"url":"http://packetstormsecurity.com/files/160619/Pulse-Secure-VPN-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601","tags":["Broken Link","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/160619/Pulse-Secure-VPN-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601","tags":["Broken Link","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8260","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Exploited via admin web interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"could allow an authenticated attacker to perform an arbitrary code execution","start":72,"end":148}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary code execution is the direct impact","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could allow an authenticated attacker to perform an arbitrary code execution","start":72,"end":148}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-f144807c3c05fbc98a1a","title":"Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","date":"2022-05-09","mentions":[{"quote":"Pulse Secure VPN systems affected by CVE-2019-11510, CVE-2020-8260, CVE-2020-8243, CVE-2021-22893, CVE-2021-22894, CVE-2021-22899, and CVE-2021-22900","start":62242,"end":62391}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-29130","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29130","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Pulse Secure VPN gzip RCE","module":"exploit/linux/http/pulse_secure_gzip_rce","type":"exploit","disclosureDate":"2020-10-26","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pulse_secure_gzip_rce.rb"}],"first":{"date":"2020-10-26","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pulse_secure_gzip_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/160619/Pulse-Secure-VPN-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2020-10-26","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pulse_secure_gzip_rce.rb","provenance":"source"},{"date":"2020-10-28","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8260","provenance":"source"},{"date":"2021-04-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-110a","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29130","provenance":"source"},{"date":"2022-05-09","kind":"report","label":"Named in microsoft.com: Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":371},"priority":{"score":81.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2018 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9988"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}