Loading vulnerability…
Authenticated RCE in Pulse Connect Secure via uncontrolled gzip extraction
CVE-2020-8260 is an uncontrolled gzip extraction vulnerability in the administrative web interface of Pulse Connect Secure versions earlier than 9.1R9. The flaw, also characterized as unrestricted file upload, allows an authenticated attacker to execute arbitrary code on an affected appliance. It has been exploited in attacks involving multiple Pulse Connect Secure vulnerabilities.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary code execution on the affected Pulse Connect Secure appliance. Campaigns involving this vulnerability alongside other Pulse Connect Secure flaws deployed webshells supporting credential harvesting, authentication and MFA bypass, arbitrary command execution, and persistence across software updates. These campaign-level outcomes cannot be attributed exclusively to CVE-2020-8260.
If you can’t patch tonight, do this now.
Use the Pulse Secure Connect Integrity Tool to check for unauthorized modifications and review appliance web-request and authentication logs. Preserve evidence before running the tool or upgrading: the tool requires a reboot, and its visibility is limited to the currently running software version. For compromised appliances, disable the external interface during remediation. No vulnerability-specific temporary workaround is established for CVE-2020-8260.
Patch, then assume compromise.
Upgrade Pulse Connect Secure to a supported release containing the CVE-2020-8260 fix; versions earlier than 9.1R9 are affected. Apply the fixes associated with Security Advisory SA44601. If compromise is suspected, preserve forensic evidence before upgrading or resetting the appliance. For confirmed compromise, follow appliance recovery guidance, including factory reset and software update, reset potentially exposed credentials, and investigate the broader environment. Patching alone does not eliminate stolen credentials or established attacker access.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.