CVE-2020-8243VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-8243: Ivanti Pulse Connect Secure Code Execution Vulnerability

Affects Ivanti Pulse Connect SecureSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 90.8% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

Description

CVE-2020-8243 is a high-severity vulnerability in Ivanti Pulse Connect Secure's admin web interface. It allows an authenticated attacker to upload a custom template that can lead to code execution on the affected system. This vulnerability has been exploited in the wild.

Summary

Ivanti Pulse Connect Secure contains an unspecified vulnerability in its administrative web interface that permits an authenticated attacker to upload a malicious custom template. This upload can result in arbitrary code execution, compromising the affected system. The vulnerability is tracked as CVE-2020-8243 and is associated with CWE-94 (Improper Control of Generation of Code). Exploitation has been observed in the wild, indicating active threat use.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary code on the Pulse Connect Secure device, potentially leading to full system compromise. This can undermine the security of the network and sensitive data protected by the device.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability requires authentication, restricting administrative access and monitoring for suspicious activity may help reduce risk until an official fix is available.

Weaknesses

CWE-94Code Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:56:43 UTC

Weaknesses

References

Related threats