CVE-2020-8218

7.2

HIGHCVSS v3.1 Base Score

32.25%

MEDIUM RiskEPSS (98th percentile)

KEV

A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

Published: 7/30/2020

Modified: 6/17/2026

Back to CVE Lookup

ACTIVELY EXPLOITED IN THE WILD

This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Vulnerability Name:

Pulse Connect Secure Code Injection Vulnerability

Vendor / Product:

Pulse Secure Pulse Connect Secure

Required Action:

Apply updates per vendor instructions.

Due Date: 9/7/2022(OVERDUE)

Added to KEV:

3/7/2022

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2020-8218

View CISA KEV Catalog

Vulnerability Summary

CVSS v3 Score

7.2HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2 Score

6.5

AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS Score (Exploitation Probability)

32.25%MEDIUM Exploitation Risk

98th percentile

This vulnerability has a 32.25% probability of being exploited in the next 30 days, ranking higher than 98% of all scored CVEs.

CWE Classification

CWE-94

Learn More

CVSS Calculator

View this score breakdown or calculate a custom score

Understanding CVSS Scoring

Learn how severity scores are calculated and what they mean

CVE Prioritization Guide

Best practices for deciding which vulnerabilities to address first

What is a CVE?

Essential guide to Common Vulnerabilities and Exposures

CVE vs CWE Explained

Understand how CVEs relate to underlying weakness types