Loading vulnerability…
Authenticated Code Injection in Pulse Connect Secure Custom Templates
CVE-2020-8243 is a code injection vulnerability in the administrative web interface of Pulse Connect Secure versions earlier than 9.1R8.2. An authenticated attacker can upload a custom template to execute arbitrary code on the affected appliance. The vulnerability has been exploited in campaigns involving multiple Pulse Connect Secure vulnerabilities.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary code execution on the affected Pulse Connect Secure appliance. The execution privilege level is not specified. Campaigns involving this and other Pulse Connect Secure vulnerabilities deployed webshells for credential harvesting, authentication bypass, command execution, and persistence through software updates; those outcomes are not individually attributed to CVE-2020-8243.
If you can’t patch tonight, do this now.
Use the Pulse Connect Secure Integrity Tool to assess potential compromise and review appliance web-request and authentication logs. Preserve evidence before running the tool because it requires a reboot. Integrity checks cover the currently running software version and may miss evidence from earlier versions after upgrades. A CVE-2020-8243-specific preventive workaround is not established.
Patch, then assume compromise.
Upgrade Pulse Connect Secure to version 9.1R8.2 or later with the applicable vendor fixes, following Security Advisory SA44588. If compromise is suspected, preserve forensic evidence and assess appliance integrity before remediation. For compromised appliances, follow vendor incident-response guidance, including factory reset and software updates, reset potentially exposed credentials, and investigate the broader network for persistent attacker access. Patching alone does not invalidate stolen credentials.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.