CVE-2020-8243
Ivanti Pulse Connect Secure Code Execution Vulnerability
Description
CVE-2020-8243 is a high-severity code injection vulnerability in Ivanti Pulse Connect Secure. The flaw resides in the admin web interface of Pulse Connect Secure versions prior to 9.1R8.2, where an authenticated attacker can upload a custom template to achieve arbitrary code execution on the underlying system. CISA has added CVE-2020-8243 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and it is referenced in CISA Emergency Directive 21-03. With an EPSS score of 25.63% (96.2nd percentile), this Ivanti Pulse Connect Secure vulnerability represents a significant threat to organizations relying on this VPN appliance for remote access.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect secure | <= 9.0; 9.1 |
| ivanti | policy secure | <= 9.0; 9.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44588(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8243(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code injection occurs when an application allows untrusted input to be incorporated into dynamically generated code that is then executed. In the case of CVE-2020-8243, the Pulse Connect Secure admin web interface fails to properly validate uploaded template files, enabling an authenticated attacker to inject and execute arbitrary code on the server.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2020-8243 carries a CVSS 3.1 score of 7.2 (HIGH), reflecting a serious security threat. The vulnerability is remotely exploitable over the network with low attack complexity, though it requires high-level privileges (administrator access) and no user interaction. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected Pulse Connect Secure appliance. An attacker with administrator credentials could execute arbitrary code on the VPN gateway, potentially intercepting VPN traffic, extracting credentials, deploying backdoors, or pivoting into the internal network. The EPSS score of 25.63% places this vulnerability in the 96.2nd percentile, indicating a high probability of active exploitation.
Exploit Maturity
CVE-2020-8243 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog, with federal agencies required to remediate by 2022-05-03 under Emergency Directive 21-03. The EPSS score of 25.63% (96.2nd percentile) indicates a high probability of exploitation activity. While no public proof-of-concept exploit code is directly tagged in the NVD references, the vendor advisory from Pulse Secure documents the vulnerability in detail. This vulnerability is part of a broader set of Pulse Connect Secure flaws (including CVE-2020-8260, CVE-2021-22893, and CVE-2021-22894) that have been actively targeted by advanced threat actors to compromise VPN infrastructure.
Remediation
- Apply vendor patches immediately as required by CISA KEV directive: Apply updates per vendor instructions. Upgrade Ivanti Pulse Connect Secure to version 9.1R8.2 or later to fully address CVE-2020-8243.
- Verify that all instances of affected products — Ivanti Connect Secure versions 9.0 and earlier, and version 9.1 prior to 9.1R8.2 — have been updated, including both Connect Secure and Policy Secure appliances.
- Restrict access to the Pulse Connect Secure admin web interface to a dedicated management network or specific trusted IP addresses only, reducing the attack surface for authenticated exploits.
- Review admin account credentials and audit administrator access logs for any unauthorized login attempts or suspicious template upload activity that could indicate prior exploitation.
- Implement file integrity monitoring on the Pulse Connect Secure appliance to detect unauthorized modifications to templates and system files, and perform a thorough review of the system using the Pulse Connect Secure Integrity Checker Tool provided by Ivanti.
Technical Details
CVE-2020-8243 exploits a code injection weakness (CWE-94) in the admin web interface of Pulse Connect Secure versions prior to 9.1R8.2. The vulnerability allows an authenticated administrator to upload a specially crafted custom template that contains embedded code, which is then executed by the server-side template engine without proper sanitization or sandboxing. The CVSS vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms that while network-accessible and easy to exploit technically, the attack requires high privileges — specifically, valid administrator credentials. Once exploited, the attacker gains code execution as the application process, resulting in full compromise of the confidentiality, integrity, and availability of the VPN appliance and potentially the broader network it protects.
Frequently Asked Questions
Is CVE-2020-8243 being actively exploited?
Yes. CVE-2020-8243 is listed in the CISA Known Exploited Vulnerabilities catalog and is covered under Emergency Directive 21-03, confirming active exploitation by threat actors targeting Pulse Connect Secure appliances. The EPSS score of 25.63% (96.2nd percentile) further reinforces the high likelihood of exploitation.
What products are affected by CVE-2020-8243?
CVE-2020-8243 affects Ivanti Pulse Connect Secure (formerly Pulse Secure) versions 9.0 and earlier, as well as version 9.1 before 9.1R8.2. Ivanti Policy Secure versions 9.0 and earlier and 9.1 are also affected.
How do I fix CVE-2020-8243?
Upgrade Ivanti Pulse Connect Secure to version 9.1R8.2 or later. Restrict admin web interface access to trusted management networks, audit administrator credentials, and run the Pulse Connect Secure Integrity Checker Tool to verify system integrity.
How severe is CVE-2020-8243?
CVE-2020-8243 has a CVSS 3.1 score of 7.2 (HIGH). While it requires administrator-level authentication to exploit, successful exploitation grants full code execution on the VPN appliance. The 96.2nd EPSS percentile ranking indicates a very high probability of exploitation compared to other vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.