Description In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
A command injection vulnerability has been identified in Ivanti Pulse Secure products, specifically in the admin web interface of Pulse Connect Secure and Pulse Policy Secure. This vulnerability is present in several versions of Pulse Connect Secure (9.0RX prior to 9.0R3.4, 8.3RX prior to 8.3R7.1, 8.2RX prior to 8.2R12.1, and 8.1RX prior to 8.1R15.1) and Pulse Policy Secure (9.0RX prior to 9.0R3.2, 5.4RX prior to 5.4R7.1, 5.3RX prior to 5.3R12.1, 5.2RX prior to 5.2R12.1, and 5.1RX prior to 5.1R15.1). The vulnerability allows an authenticated attacker to inject and execute commands on the server.
Users are advised to update to the latest versions of Pulse Secure products. Pulse Secure has released patches for these vulnerabilities. For instructions on how to apply the updates, refer to the Pulse Secure Security Advisory SA44101.
Show AI summary Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 3, 2025 Exploitation: ActiveAutomatable: NoTechnical Impact: Total
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
This CVE is in CISA's Known Exploited Vulnerabilities Catalog Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
Vulnerability Name Date Added Due Date Required Action Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability Nov 3, 2021 May 3, 2022 Apply updates per vendor instructions.
Weakness Enumeration CWE-ID CWE Name Source CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') [email protected] CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CISA-ADP
Affected Products Product Versions ivanti connect secure 8.1 -
8.1 r1.0
8.1 r1.1
8.1 r10.0
8.1 r11.0
8.1 r11.1
8.1 r12.0
8.1 r12.1
8.1 r13.0
8.1 r14.0
8.1 r2.0
8.1 r2.1
8.1 r3.0
8.1 r3.1
8.1 r3.2
8.1 r4.0
8.1 r4.1
8.1 r5.0
8.1 r6.0
8.1 r7
8.1 r7.0
8.1 r8.0
8.1 r9.0
8.1 r9.1
8.1 r9.2
8.2
8.2 r1
8.2 r1.0
8.2 r1.1
8.2 r10.0
8.2 r11.0
8.2 r12.0
8.2 r2.0
8.2 r3.0
8.2 r3.1
8.2 r4.0
8.2 r4.1
8.2 r5.0
8.2 r5.1
8.2 r6.0
8.2 r7.0
8.2 r7.1
8.2 r7.2
8.2 r8.0
8.2 r8.1
8.2 r8.2
8.2 r9.0
8.3 -
8.3 r1
8.3 r1.1
8.3 r2
8.3 r2.1
8.3 r3
8.3 r4
8.3 r5
8.3 r5.1
8.3 r5.2
8.3 r6
8.3 r6.1
8.3 r7
9.0 r1
9.0 r2
9.0 r2.1
9.0 r3
9.0 r3.1
9.0 r3.2
9.0 r3.3
Viewing 5 of 67 versions. View all CPE cpe:2.3:a:ivanti:connect_secure:8.1:-:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r1.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r1.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r10.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r11.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r11.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r12.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r12.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r13.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r14.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r2.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r2.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r3.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r3.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r3.2:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r4.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r4.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r5.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r6.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r7:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r7.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r8.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r9.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r9.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.1:r9.2:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:*:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r1.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r1.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r10.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r11.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r12.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r2.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r3.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r3.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r4.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r4.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r5.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r5.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r6.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r7.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r7.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r7.2:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r8.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r8.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r8.2:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.2:r9.0:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:-:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:r1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:r1.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:r2:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:r2.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:r3:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:r4:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:r5:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:r5.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:r5.2:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:r6:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:r6.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:8.3:r7:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:* cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:* Remediation No remediation found in references. ivanti policy secure 9.0 r1
9.0 r2
9.0 r2.1
9.0 r3
9.0 r3.1
CPE cpe:2.3:a:ivanti:policy_secure:9.0:r1:*:*:*:*:*:* cpe:2.3:a:ivanti:policy_secure:9.0:r2:*:*:*:*:*:* cpe:2.3:a:ivanti:policy_secure:9.0:r2.1:*:*:*:*:*:* cpe:2.3:a:ivanti:policy_secure:9.0:r3:*:*:*:*:*:* cpe:2.3:a:ivanti:policy_secure:9.0:r3.1:*:*:*:*:*:* Remediation No remediation found in references. pulsesecure pulse policy secure 5.1r1.0
5.1r1.1
5.1r2.0
5.1r2.1
5.1r3.0
5.1r3.2
5.1r4.0
5.1r5.0
5.1r6.0
5.1r7.0
5.1r8.0
5.1r9.0
5.1r9.1
5.1r10.0
5.1r11.0
5.1r11.1
5.1r12.0
5.1r12.1
5.1r13.0
5.1r14.0
5.2r1.0
5.2r2.0
5.2r3.0
5.2r3.2
5.2r4.0
5.2r5.0
5.2r6.0
5.2r7.0
5.2r7.1
5.2r8.0
5.2r9.0
5.2r9.1
5.2r10.0
5.2r11.0
5.2rx
5.3r1.0
5.3r1.1
5.3r2.0
5.3r3.0
5.3r3.1
5.3r4.0
5.3r4.1
5.3r5.0
5.3r5.1
5.3r5.2
5.3r6.0
5.3r7.0
5.3r8.0
5.3r8.1
5.3r8.2
5.3r9.0
5.3r10.
5.3r11.0
5.3r12.0
5.3rx
5.4r1
5.4r2
5.4r2.1
5.4r3
5.4r4
5.4r5
5.4r5.2
5.4r6
5.4r6.1
5.4r7
5.4rx
Viewing 5 of 66 versions. View all CPE cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r1.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r1.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r2.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r2.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r3.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r3.2:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r4.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r5.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r6.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r7.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r8.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r9.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r9.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r10.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r11.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r11.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r12.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r12.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r13.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.1r14.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r1.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r2.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r3.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r3.2:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r4.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r5.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r6.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r7.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r7.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r8.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r9.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r9.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r10.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2r11.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.2rx:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r1.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r1.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r2.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r3.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r3.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r4.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r4.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r5.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r5.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r5.2:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r6.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r7.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r8.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r8.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r8.2:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r9.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r10.:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r11.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3r12.0:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.3rx:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r2:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r2.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r3:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r4:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r5:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r5.2:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r6:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r6.1:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4r7:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:pulse_policy_secure:5.4rx:*:*:*:*:*:*:* Remediation No remediation found in references.
Change History 67 change records found show changes
Date Action Recorded By Jun 17, 2026 CVE Modified CISA-ADP Jun 17, 2026 CVE Modified [email protected] Nov 6, 2025 Modified Analysis [email protected] Oct 22, 2025 CVE Modified CISA-ADP Oct 21, 2025 CVE Modified CISA-ADP Oct 21, 2025 CVE Modified CISA-ADP Apr 3, 2025 Modified Analysis [email protected] Feb 3, 2025 CVE Modified CISA-ADP Nov 21, 2024 CVE Modified CVE May 14, 2024 CVE Modified [email protected] Feb 27, 2024 CPE Deprecation Remap [email protected] Feb 27, 2024 CPE Deprecation Remap [email protected] Feb 27, 2024 CPE Deprecation Remap [email protected] Jan 27, 2023 Modified Analysis [email protected] Apr 6, 2021 CVE Modified [email protected] Aug 24, 2020 CWE Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Apr 29, 2020 CPE Deprecation Remap [email protected] Nov 12, 2019 CVE Modified [email protected] Oct 16, 2019 CVE Modified [email protected] Oct 9, 2019 CVE Modified [email protected] Sep 6, 2019 CVE Modified [email protected] Sep 6, 2019 CVE Modified [email protected] Sep 6, 2019 CVE Modified [email protected] Aug 9, 2019 CVE Modified [email protected] Apr 29, 2019 Initial Analysis [email protected] Apr 27, 2019 CVE Modified [email protected] Apr 26, 2019 CVE Modified [email protected]