CVE-2020-8256

MEDIUM 4.9CVE-2020-8256 · Published 30/09/2020 · updated 17/06/2026

In short

CVE-2020-8256 is a MEDIUM (CVSS 4.9) vulnerability affecting connect secure (ivanti), pulse connect secure (pulsesecure).
Chance of exploitation in the next 30 days (EPSS): 3.4%, higher than 88.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
connect secure ivanti	`= 9.1`	No fix yet
pulse connect secure pulsesecure	`≤ 9.0`	No fix yet

Description

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.

References

kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44588 · Vendor Advisory
gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure · Exploit

More vulnerabilities in connect secure

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

connect secure

ivanti

= 9.1

No fix yet

pulse connect secure

pulsesecure

≤ 9.0

No fix yet

More vulnerabilities in connect secure

See all →